PCAP output file issue

Help
1

Please include the following information with your help request:

  • Suricata version-7.0
  • Operating system- ubuntu
    installed using package

i have enabled pcap output in suricata.
but multiple pcap files are generating.
is it possible to have one pcap file for each day?
that is, at the end of the month, 30 or 31 pcap files should be there.

2

Are you using the pcap-log section?

If so, pcap files created by suricata have a size and count restriction. You could use logrotate to combine each day’s files into a daily digest (using mergecap)

3

there is a compression option in suricata.yml (lz4) , and i enabled it.
now new pcap files are generating (max_size is 1GB and file limit is 5)
with .lz4 extension, with size reaching upto 1GB