From c824804e2b7d2e434646cd93a838e31b4e02f147 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Sat, 9 Apr 2022 17:24:33 +0200
Subject: [PATCH] eve: allow /dev/null in threaded mode

Avoids creation of actual files called /dev/null.N which take
up space in /dev/ which lives in memory.
---
 src/util-logopenfile.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index 90626aad51..84c1bc2cc8 100644
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -711,6 +711,11 @@ LogFileCtx *LogFileEnsureExists(LogFileCtx *parent_ctx, int thread_id)
 static bool LogFileThreadedName(
         const char *original_name, char *threaded_name, size_t len, uint32_t unique_id)
 {
+    if (strcmp("/dev/null", original_name) == 0) {
+        strlcpy(threaded_name, original_name, len);
+        return true;
+    }
+
     const char *base = SCBasename(original_name);
     if (!base) {
         FatalError(SC_ERR_FATAL,
-- 
2.47.2