[Oisf-users] Config options discrepancies between suricata.yaml and ConfNodeLookupChildValue() in the source.

[Victor Julien]

On 02/16/2012 03:16 PM, Nikolay Denev wrote:
> Hi,
> 
> I've noticed that there are some discrepancies regarding the config options that are in the default suricata.yaml file, that
> I guess most people use as a starting point to modify for their needs. For example I've tried to set the pcap logging to use only 10 files and rotate them,
> and I noticed that this didn't work. I've found that the source uses "ConfNodeLookupChildValue(conf, "max-files");" to get the number of files, but suricata.yaml
> has "max_files", so this option is not parsed.
> I see other similar mixups of dashes and underscores like : 
> 
> /usr/local/etc/suricata/suricata.yaml:      use_stream_depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
> ./log-pcap.c:        use_stream_depth = ConfNodeLookupChildValue(conf, "use-stream-depth");
> 
> ./log-pcap.c:            s_dir = ConfNodeLookupChildValue(conf, "sguil-base-dir");
> ./log-pcap.c:                s_dir = ConfNodeLookupChildValue(conf, "sguil_base_dir");
> 
> 
> ts-format and ts_format…
> 
> I can try to prepare a patch for these when I have free time, if it's clear what should be the convention: underscore or dash.

Yeah it's inconsistent. The goal is to have the dash approach
everywhere. Complicating things is that for every setting we convert, I
want the old way to continue to work. So backwards compatibility, like
with the sguil-base-dir.

Still interested in helping out? :)

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------