From 0de9eee04d967a4dc8c0ba7d0bc57789f4d8a1f2 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 6 Dec 2024 14:13:14 +0100 Subject: [PATCH] eve/frame: require frame length to be known Or reach logging threshold. Avoids logging too early. Ticket: #7440. --- src/output-json-frame.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/output-json-frame.c b/src/output-json-frame.c index 6a3cf768a4..3fc875b051 100644 --- a/src/output-json-frame.c +++ b/src/output-json-frame.c @@ -369,7 +369,9 @@ static int FrameJson(ThreadVars *tv, JsonFrameLogThread *aft, const Packet *p) int64_t abs_offset = (int64_t)frame->offset + (int64_t)STREAM_BASE_OFFSET(stream); int64_t win = STREAM_APP_PROGRESS(stream) - abs_offset; - if (!eof && win < frame->len && win < 2500) { + /* skip frame if threshold not yet reached, esp if frame length is + * still unknown. */ + if (!eof && ((frame->len == -1) || (win < frame->len)) && win < 2500) { SCLogDebug("frame id %" PRIi64 " len %" PRIi64 ", win %" PRIi64 ", skipping logging", frame->id, frame->len, win); -- 2.47.3