config: Document cluster_rollover deprecation

Issue: 6128

cluster_rollover is no longer permitted; using it will generate a
warning message and it'll be replaced with cluster_flow

diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index badaaf7343f96f4157f48b62d2da99d9fc2a69ac..d96c836d972af106cf2324a8f37c57c4e3dbf447 100644 (file)
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -74,8 +74,8 @@ Deprecations
 - Multiple "include" fields in the configuration file will now issue a
   warning and in Suricata 8.0 will not be supported. See
   :ref:`includes` for documentation on including multiple files.
-- For AF-Packet, the `cluster_rollover` setting is no longer supported. If this is used, a warning
-  message will be printed and `cluster_flow` will be used instead.
+- For AF-Packet, the `cluster_rollover` setting is no longer supported. Configuration settings using ``cluster_rollover``
+  will cause a warning message and act as though `cluster_flow`` was specified. Please update your configuration settings.
 
 Other changes
 ~~~~~~~~~~~~~

diff --git a/suricata.yaml.in b/suricata.yaml.in
index 9f409b80a9790485f000fb66c3c8a7e7dce6a201..af7ad5344b726d49683bd5f7d19dcfad5dacf7ee 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -621,6 +621,7 @@ af-packet:
     #  more info.
     # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
     # with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)
+    # cluster_rollover has been deprecated; if used, it'll be replaced with cluster_flow.
     cluster-type: cluster_flow
     # In some fragmentation cases, the hash can not be computed. If "defrag" is set
     # to yes, the kernel will do the needed defragmentation before sending the packets.