# Drop log false positive records possible since 6.0.6?

**URL:** https://forum.suricata.io/t/drop-log-false-positive-records-possible-since-6-0-6/3228
**Category:** Help
**Tags:** suricata, ips, opnsense, events
**Created:** [February 15, 2023, 8:45am UTC](https://forum.suricata.io/t/drop-log-false-positive-records-possible-since-6-0-6/3228 "2023-02-15T08:45:30Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![Fright](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/fright/32/501_2.png) [@Fright](https://forum.suricata.io/u/Fright)
#### Post date: [February 15, 2023, 8:45am UTC](https://forum.suricata.io/t/drop-log-false-positive-records-possible-since-6-0-6/3228/1 "2023-02-15T08:45:30Z")

</div>

Hi!  
we have two opnsense instances with Suricata in IPS mode on both. one with 6.0.5 and one with 6.0.9.  
both have eve-log drop alerts enabled with:

- drop:  
alerts: yes # log alerts that caused drops  
flows: start

both instances have two test rules like:  
pass tcp 172.17.1.0/24 any → any 225 (msg:“PASS LOCAL NET Port 225::no flags::flow to\_server::no thresholds”; flow:to\_server; classtype:misc-activity; sid:1000100; rev:1; metadata:created\_at 2023\_02\_07, updated\_at 2023\_02\_07;)  
and  
drop tcp 172.17.1.0/24 any → any 225 (msg:“DROP LOCAL NET Port 225::A12flags::flow established: to\_server::no thresholds”; flow:to\_server,established; flags: A,12; classtype:misc-activity; sid:1000103; rev:1; metadata:created\_at 2023\_02\_07, updated\_at 2023\_02\_07;)

both instances have test smtp server listening on tcp 225  
smtp session works on both instances. but…on 6.0.9 it produces “drop” event\_type records in eve-log for sid:1000103.

can it be related to [Optimization #5127: alerts: use alert queing in DetectEngineThreadCtx (6.0.x backport) - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/5127) (and setting drop action in AlertQueueAppend())?  
thanks!

---

_[View the full topic](https://forum.suricata.io/t/drop-log-false-positive-records-possible-since-6-0-6/3228)._