detect/firewall: update discarded logic

Only count alert queue overflow here, not alerts in the queue after a drop.

doc/userguide/firewall/firewall-stats.rst

@@ -29,6 +29,9 @@ If a drop was caused by the firewall, the corresponding counter will be incremen
 Discarded alerts
 ================
 
-In Firewall mode, alerts generated *after* a drop are discarded.
+When the alert queue is full for a firewall rule match, the alert is discarded.
 These are reported with the counter ``stats.firewall.discarded_alerts``.
 Note that the drop may be caused by non-firewall rules.
+
+The rule's primary action as well as other secondary actions will be applied to
+the traffic as normal.

etc/schema.json

@@ -7549,7 +7549,7 @@
                         },
                         "discarded_alerts": {
                             "type": "integer",
-                            "description": "Count of alerts discarded due to a drop while in firewall mode"
+                            "description": "Count of alerts discarded due max alerts reached"
                         },
                         "drop_reason": {
                             "type": "object",

src/detect-engine-alert.c

@@ -632,8 +632,7 @@ static inline void PacketAlertFinalizeProcessQueue(
             }
 
             if (dropped) {
-                SCLogDebug("Skippig firewall signature after a drop.");
-                p->alerts.firewall_discarded++;
+                SCLogDebug("Skipping firewall signature after a drop.");
                 continue;
             }