output/buffer: Change buffer-size default value

The buffer-size value that controls file output buffering defaults to
8k. To be consistent with previous logic, the default is being changed
to 0 (e.g., needed if there are old config files that don't specifically
enable the new value).

diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index c27dcf8bab2c67fad369458f8dc8538d521480c5..e793850e0fb429d6d4174a150a546a46aeecdb04 100644 (file)
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -533,6 +533,7 @@ SCConfLogOpenGeneric(ConfNode *conf,
 
     /* Determine the buffering for this output device; a value of 0 means to not buffer;
      * any other value must be a multiple of 4096
+     * The default value is 0 (no buffering)
      */
     uint32_t buffer_size = LOGFILE_EVE_BUFFER_SIZE;
     const char *buffer_size_value = ConfNodeLookupChildValue(conf, "buffer-size");

diff --git a/src/util-logopenfile.h b/src/util-logopenfile.h
index 19c9e5e1c7179e904181741bc30d4e005de091ad..735d93b56ae5187bb459e82848594e3ade0ed065 100644 (file)
--- a/src/util-logopenfile.h
+++ b/src/util-logopenfile.h
@@ -172,7 +172,7 @@ typedef struct LogFileCtx_ {
 #define LOGFILE_ROTATE_INTERVAL 0x04
 
 /* Default EVE output buffering size */
-#define LOGFILE_EVE_BUFFER_SIZE (8 * 1024)
+#define LOGFILE_EVE_BUFFER_SIZE 0
 
 LogFileCtx *LogFileNewCtx(void);
 int LogFileFreeCtx(LogFileCtx *);

diff --git a/suricata.yaml.in b/suricata.yaml.in
index 40484ea1c4a3f143cd5f6eff8688cb89bf43072e..4d46c2502ff038398b13c3fd99279319e9436f93 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -104,7 +104,7 @@ outputs:
       # Specify the amount of buffering, in bytes, for
       # this output type. The default value 0 means "no
       # buffering".
-      buffer-size: 0
+      #buffer-size: 0
       #prefix: "@cee: " # prefix to prepend to each log entry
       # the following are valid when type: syslog above
       #identity: "suricata"