Suricata in socket mode: determining if a PCAP is done processing

And for what it’s worth, I did read these forum posts (here and here) but those weren’t particularly helpful, as the suggestions there mostly just recommended reading the documentation (which I’ve done) and doing the PCAPs one at a time (which I don’t think solves the problem).

More specifically, the feedback I’m looking for is on my idea of checking the results of pcap-file-list and the existence of eve.json (I’m specifying a different output directory for each pcap I send with pcap-file) to determine if it’s finished processing or not.