Hi, Suricata Team:
Can we add an expire variable in the pcap-log settings? If the PCAP hasn’t reached the storage size limit, but meets the expire requirement, Suricata will record subsequent alerts in a new PCAP.
- pcap-log:
enabled: yes
filename: log-%n-%t.pcap
# File size limit. Can be specified in kb, mb, gb. Just a number
# is parsed as bytes.
limit: 10mb
# File expiration limit. Can be specified in sec, min, or hour.
expire: 60sec
# If set to a value, ring buffer mode is enabled. Will keep maximum of
# "max-files" of size "limit"
max-files: 1000