Commit Graph

14 Commits (7b20488d4e104d7c3693b25810c77e7756050424)

Author SHA1 Message Date
Jason Ish 4b9af8d2ce doc/userguide: document --disable-hashing 4 years ago
Victor Julien ca47d75c80 doc/userguide: explain --strict-rule-keywords 4 years ago
Jason Ish f70e1f571e doc/userguide: add info about --set and lists 4 years ago
James Dutrisac 8d5e54c046 pcap: recusively reading pcaps / documentation
Changes to doc/userguide/partials/options.rst for feature 2363
   (reading pcaps recursively)
5 years ago
Victor Julien 75727c05e0 doc/manpage: add --reject-dev option 5 years ago
Jeff Lucovsky 3385859176 doc/userguide: Update for dump-features 5 years ago
Daisu fccdb1c642 doc/commandline: -i option is useable several times 5 years ago
Jason Ish 9111b9df57 doc: cleanup enging logging
Attempt cleanup the engine logging a bit.

Also a include a verbatim excerpt of the default configuration
here for reference purposes.
5 years ago
Jason Ish c97195bf0b doc: -v verbose option documentation update
Update -v documentation to reflect the new behaviour discussed
in bug #1851 where -v changes the log level to fixed levels
instead of an offset of the default log level configured
in suricata.yaml.
5 years ago
Victor Julien 6fcd2db043 tile: remove files 6 years ago
Danny Browning 2dc6b6ee14 source-pcap-file: delete when done (2417)
https://redmine.openinfosecfoundation.org/issues/2417

Add option to have pcap files deleted after they have been processed.
This option combines well with pcap file continuous and streaming
files to a directory being processed.
7 years ago
Brandon Sterne a01a229b37 doc: use standard spelling of daemon 7 years ago
Dana Helwig 3ab9120821 source-pcap-file: Pcap Directory Mode (Feature #2222)
https://redmine.openinfosecfoundation.org/issues/2222

Pcap file mode that when passed a directory will process all files in
that directory. If --pcap-file-continuous or continuous option is passed
in json, the directory will be monitored  until the directory is
moved/deleted, suricata is interrupted, or the pcap-interrupt command
is used with unix command socket. Existing file implementation and new
directory implementation has moved from source-pcap-file into
pcap-file-helper and pcap-directory-helper.

Engine state will not reset between files.

Also satisfies:
 * https://redmine.openinfosecfoundation.org/issues/2299
 * https://redmine.openinfosecfoundation.org/issues/724
 * https://redmine.openinfosecfoundation.org/issues/1476

Co-Authors: Dana Helwig <dana.helwig@protectwise.com> and
Danny Browning <danny.browning@protectwise.com>
7 years ago
Jason Ish 5c78fdbc9c doc: break out command line options into a common doc
The command line options can now be consumed by the man page
and the user guide.

Some attempt was made to order the options from common/basic
progressing to advanced with some notion of options
grouped together.
9 years ago