what is different between suricata workers and autofp on eve.log?
Hi Gary,
workers and autofp are “runmodes”. See 9.1. Runmodes — Suricata 6.0.3 documentation for documentation.
Essentially, they control how Suricata manages the packet flow – autofp uses a single thread to capture packets – this thread distributes packets to one or more worker threads (note: there can be multiple capture threads). workers differs in that an individual worker thread handles packet capture, processing. When there is one worker thread configured, that runmode is single
Hello Jeff，
When I used autofp,the output logs in eve.json are connect, such as the http-head and body contain in one record, but in workers runmodes, http-head and http-body were recorded with two logs. I want to know why. Thank you!
Hi Gary,
By recorded with two logs – this means two log entries within eve.json?
Can you post a snippet with the appropriate masking of any private information?