doc/devguide: explain alert logging changes

diff --git a/doc/userguide/devguide/upgrading/index.rst b/doc/userguide/devguide/upgrading/index.rst
index fb5d0c3e6ab189bc6dc4e053d27fc8cdb229f7b6..6c539e85d21cf76883724b4f0a0e38275c3c495f 100644 (file)
--- a/doc/userguide/devguide/upgrading/index.rst
+++ b/doc/userguide/devguide/upgrading/index.rst
@@ -1,6 +1,18 @@
 Upgrading
 =========
 
+Upgrading 8.0 to 9.0
+--------------------
+
+Alert Logging
+~~~~~~~~~~~~~
+
+Alert logging is done by iterating the `PacketAlert` entries in `Packet::alerts`. In 9.0
+it is important to check the `PacketAlert::action` field for the `ACTION_ALERT` flag. If
+this flag is not set, no alert should be generated. This is to support the `pass`-rule
+usecase better.
+
+
 Upgrading 7.0 to 8.0
 --------------------