[Oisf-users] Meaning of force-filestore option

[Darren S.]

Suricata version 4.0.4 RELEASE

outputs.13.file-store = (null)
outputs.13.file-store.enabled = yes
outputs.13.file-store.log-dir = files
outputs.13.file-store.force-magic = yes
outputs.13.file-store.force-md5 = yes
outputs.13.file-store.force-filestore = no

I'd like to find out what is the meaning of the force-* options in
these types of settings - understanding that they force the given data
output, but not what that means by example.

For example, would outputs.file-store.force-filestore result in Suri
storing all files regardless of any filestore rules active (as a
convenience factor)?

What cases do force-magic and force-md5 output those values where they
wouldn't normally be output when file-store.enabled = yes?

-- 
Darren Spruell
phatbuckett at gmail.com