From 0c7e4c13a1a2fd2b26729e6393193efd25dbcf7d Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Sat, 6 Feb 2021 23:17:30 +0100 Subject: [PATCH] doc: add conditional pcap logging info --- doc/userguide/configuration/suricata-yaml.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst index 73a9de8186..7b675df346 100644 --- a/doc/userguide/configuration/suricata-yaml.rst +++ b/doc/userguide/configuration/suricata-yaml.rst @@ -471,6 +471,16 @@ By default all packets are logged except: - TCP streams beyond stream.reassembly.depth - encrypted streams after the key exchange +It is possible to do conditional pcap logging by using the `conditional` +option in the pcap-log section. By default the variable is set to `all` +so all packet are logged. If the variable is set to `alerts` then only +the flow with alerts will be logged. If the variable is set to `tag` +then only packets tagged by signature using the `tag` keyword will +be logged to the pcap file. Please note that if `alerts` or `tag` is +used, then in the case of TCP session, Suricata will use available +information from the streaming engine to log data that have triggered +the alert. + :: - pcap-log: @@ -482,6 +492,7 @@ By default all packets are logged except: mode: sguil # "normal" (default) or sguil. sguil_base_dir: /nsm_data/ + conditional: alerts Verbose Alerts Log (alert-debug.log) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- 2.47.2