From: Victor Julien <victor@inliniac.net>
Date: Wed, 4 Nov 2020 20:00:41 +0000 (+0100)
Subject: doc/userguide: explain --strict-rule-keywords
X-Git-Tag: suricata-6.0.1~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ca47d75c8057af70e13ab0e0f2f3e5dace933b02;p=thirdparty%2Fsuricata.git

doc/userguide: explain --strict-rule-keywords
---

diff --git a/doc/userguide/partials/options.rst b/doc/userguide/partials/options.rst
index cb871e16d0..ef3b9f6803 100644
--- a/doc/userguide/partials/options.rst
+++ b/doc/userguide/partials/options.rst
@@ -48,6 +48,7 @@
    flow state between files.
 
 .. option:: --pcap-file-recursive
+
    Used with the -r option when the path provided is a directory.  This option
    enables recursive traversal into subdirectories to a maximum depth of 255.
    This option cannot be combined with --pcap-file-continuous.  Symlinks are
@@ -153,6 +154,20 @@
 
    Exit with a failure when errors are encountered loading signatures.
 
+.. option:: --strict-rule-keywords[=all|<keyword>|<keywords(csv)]
+
+   Applies to: classtype, reference and app-layer-event.
+
+   By default missing reference or classtype values are warnings and
+   not errors. Additionally, loading outdated app-layer-event events are
+   also not treated as errors, but as warnings instead.
+
+   If this option is enabled these warnings are considered errors.
+
+   If no value, or the value 'all', is specified, the option applies to
+   all of the keywords above. Alternatively, a comma separated list can
+   be supplied with the keyword names it should apply to.
+
 .. option:: --disable-detection
 
    Disable the detection engine.