typedef struct PcapLogData_ {
int use_stream_depth; /**< use stream depth i.e. ignore packets that reach limit */
int honor_pass_rules; /**< don't log if pass rules have matched */
- int is_private; /**< TRUE if ctx is thread local */
SCMutex plog_lock;
uint64_t pkt_cnt; /**< total number of packets */
struct pcap_pkthdr *h; /**< pcap header struct */
uint64_t profile_data_size; /**< track in bytes how many bytes we wrote */
uint32_t file_cnt; /**< count of pcap files we currently have */
uint32_t max_files; /**< maximum files to use in ring buffer mode */
+ bool is_private; /**< true if ctx is thread local */
LogModeConditionalType
conditional; /**< log all packets or just packets and flows with alerts */
copy->suffix = pl->suffix;
/* settings TODO move to global cfg struct */
- copy->is_private = TRUE;
+ copy->is_private = true;
copy->mode = pl->mode;
copy->max_files = pl->max_files;
copy->use_ringbuffer = pl->use_ringbuffer;