logging: only do non-blocking writes if live

If running against a pcap there is no reason to drop events,
a blocking socket is fine here. So only do non-blocking writes
when running off a live device.

src/suricata.c

@@ -197,6 +197,9 @@ volatile uint8_t suricata_ctl_flags = 0;
 /** Run mode selected */
 int run_mode = RUNMODE_UNKNOWN;
 
+/** Is this an offline run mode. */
+int run_mode_offline = 0;
+
 /** Engine mode: inline (ENGINE_MODE_IPS) or just
   * detection mode (ENGINE_MODE_IDS by default) */
 static enum EngineMode g_engine_mode = ENGINE_MODE_IDS;
@@ -2342,8 +2345,9 @@ static int FinalizeRunMode(SCInstance *suri, char **argv)
         default:
             break;
     }
-    /* Set the global run mode */
+    /* Set the global run mode and offline flag. */
     run_mode = suri->run_mode;
+    run_mode_offline = suri->offline;
 
     if (!CheckValidDaemonModes(suri->daemon, suri->run_mode)) {
         return TM_ECODE_FAILED;

src/suricata.h

@@ -194,6 +194,7 @@ int RunmodeGetCurrent(void);
 int IsRuleReloadSet(int quiet);
 
 extern int run_mode;
+extern int run_mode_offline;
 
 void PreRunInit(const int runmode);
 void PreRunPostPrivsDropInit(const int runmode);

src/util-logopenfile.c

@@ -138,7 +138,7 @@ tryagain:
     errno = 0;
     if (ctx->fp != NULL) {
         int fd = fileno(ctx->fp);
-        ssize_t size = send(fd, buffer, buffer_len, MSG_DONTWAIT);
+        ssize_t size = send(fd, buffer, buffer_len, ctx->send_flags);
         if (size > -1) {
             ret = 0;
         } else {
@@ -505,6 +505,12 @@ SCConfLogOpenGeneric(ConfNode *conf,
         return -1;
     }
 
+    /* If a socket and running live, do non-blocking writes. */
+    if (log_ctx->is_sock && run_mode_offline == 0) {
+        SCLogInfo("Setting logging socket of non-blocking in live mode.");
+        log_ctx->send_flags |= MSG_DONTWAIT;
+    }
+
     SCLogInfo("%s output device (%s) initialized: %s", conf->name, filetype,
               filename);
 

src/util-logopenfile.h

@@ -122,6 +122,9 @@ typedef struct LogFileCtx_ {
     /* flag to avoid multiple threads printing the same stats */
     uint8_t flags;
 
+    /* flags to set when sending over a socket */
+    uint8_t send_flags;
+
     /* Flag if file is a regular file or not.  Only regular files
      * allow for rotataion. */
     uint8_t is_regular;