[Oisf-users] Limiting packet logging to alerting packets only

[Darren Spruell]

Hi,

Curious if there's a way to get a pcap log for only packets triggering
rule hits. My read of the 'pcap-log' option is that it logs _all_
packets (except for those cases excluded per docs), but just the
interesting traffic would be ideal at times.

Suricata version 1.1beta2

-- 
Darren Spruell
phatbuckett at gmail.com