<div dir="ltr">Sorry for the late response, for the request length I think I copied Matt's code and put it in here to include the request length. I don't remember doing a patch or merge at the time. Sorry for forgetting to mention credit so please replace my name with his for the request length portion.<div>
<br></div><div style>Vince</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, May 27, 2013 at 2:33 PM, I. Sanchez <span dir="ltr"><<a href="mailto:sanchezmartin.ji@gmail.com" target="_blank">sanchezmartin.ji@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>I received the code from Vincent Fang in a pull request to my repo.<br><br><a href="https://github.com/owlsec/suricata/pull/1" target="_blank">https://github.com/owlsec/suricata/pull/1</a><br>
<br></div>so I mentioned vinfang as the source for the patch in the PR<br>
<br> <i>  "Added %b for request size (vinfang patch)"</i><br><br></div>I don't know if Vincent Fang implemented it himself (3 lines) or took it from Mat's patch, but it implements the same functionality this is why I mentioned it was included in the PR #377<br>

<br></div>Cheers,<br><br></div>  Ignacio<br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, May 27, 2013 at 3:22 PM, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 05/26/2013 12:03 PM, I. Sanchez wrote:<br>
> Hi,<br>
><br>
> The patch is included in the Pull Request 377 regarding feature #602<br>
><br>
> <a href="https://github.com/inliniac/suricata/pull/377" target="_blank">https://github.com/inliniac/suricata/pull/377</a><br>
> <a href="https://redmine.openinfosecfoundation.org/issues/602" target="_blank">https://redmine.openinfosecfoundation.org/issues/602</a><br>
<br>
</div>I don't see Mathews commit in the PR, how did you merge it?<br>
<br>
Or did you mean that you already implemented the same thing yourself?<br>
<br>
Cheers,<br>
Victor<br>
<div><br>
><br>
> Cheers,<br>
><br>
>   Ignacio<br>
><br>
><br>
><br>
><br>
> On Sun, May 26, 2013 at 6:26 AM, <<a href="mailto:mathewm@sdf.lonestar.org" target="_blank">mathewm@sdf.lonestar.org</a><br>
</div><div>> <mailto:<a href="mailto:mathewm@sdf.lonestar.org" target="_blank">mathewm@sdf.lonestar.org</a>>> wrote:<br>
><br>
>     On Thu, 28 Mar 2013 10:37:10 +0100, Victor Julien<br>
</div><div>>     <<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>>> wrote:<br>
><br>
>         On 03/23/2013 10:46 AM, <a href="mailto:mathewm@sdf.lonestar.org" target="_blank">mathewm@sdf.lonestar.org</a><br>
</div><div>>         <mailto:<a href="mailto:mathewm@sdf.lonestar.org" target="_blank">mathewm@sdf.lonestar.org</a>> wrote:<br>
><br>
>             Added request length to custom HTTP logging<br>
><br>
>             Custom HTTP logging currently provides access to the HTTP<br>
>             response<br>
>             length (via %B in the custom log format string), but not the<br>
>             request<br>
>             length. The request length can be very valuable.<br>
><br>
>             I've modified log-httplog.c to provide access to libhtp's<br>
>             request_message_len, via %b in the custom log format.<br>
><br>
><br>
>         Interesting addition. Was going to apply it, but my git rejects<br>
>         it. Can<br>
>         you retry sending it against the current master, or attach a "git<br>
>         format-patch -1" file? A github pr works as well.<br>
><br>
>         Cheers,<br>
>         Victor<br>
><br>
><br>
>     Sorry for the delay, I need to pay more attention to my email!<br>
><br>
>     A corrected patch file is attached, which I managed to successfully<br>
>     test locally so with any luck this one will be OK.<br>
><br>
>     Cheers<br>
><br>
>     Mat<br>
>     _______________________________________________<br>
>     Suricata IDS Devel mailing list:<br>
>     <a href="mailto:oisf-devel@openinfosecfoundation.org" target="_blank">oisf-devel@openinfosecfoundation.org</a><br>
</div>>     <mailto:<a href="mailto:oisf-devel@openinfosecfoundation.org" target="_blank">oisf-devel@openinfosecfoundation.org</a>><br>
<div>>     Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Participate:<br>
>     <a href="http://suricata-ids.org/participate/" target="_blank">http://suricata-ids.org/participate/</a><br>
>     List:<br>
>     <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
>     Redmine: <a href="https://redmine.openinfosecfoundation.org/" target="_blank">https://redmine.openinfosecfoundation.org/</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Suricata IDS Devel mailing list: <a href="mailto:oisf-devel@openinfosecfoundation.org" target="_blank">oisf-devel@openinfosecfoundation.org</a><br>
> Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Participate: <a href="http://suricata-ids.org/participate/" target="_blank">http://suricata-ids.org/participate/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
> Redmine: <a href="https://redmine.openinfosecfoundation.org/" target="_blank">https://redmine.openinfosecfoundation.org/</a><br>
><br>
<br>
<br>
</div><span><font color="#888888">--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
</font></span><div><div><br>
_______________________________________________<br>
Suricata IDS Devel mailing list: <a href="mailto:oisf-devel@openinfosecfoundation.org" target="_blank">oisf-devel@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Participate: <a href="http://suricata-ids.org/participate/" target="_blank">http://suricata-ids.org/participate/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
Redmine: <a href="https://redmine.openinfosecfoundation.org/" target="_blank">https://redmine.openinfosecfoundation.org/</a><br>
</div></div></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Suricata IDS Devel mailing list: <a href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Participate: <a href="http://suricata-ids.org/participate/" target="_blank">http://suricata-ids.org/participate/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
Redmine: <a href="https://redmine.openinfosecfoundation.org/" target="_blank">https://redmine.openinfosecfoundation.org/</a><br></blockquote></div><br></div>