Bug/12373 v1 Suricata respects user-configured log dir

[KEIAHNY]

PR Type

Bug fix

---

Description

• Add set_log_dir to pass configured log directory

• Invoke set_log_dir when building Suricata command

---

Diagram Walkthrough

flowchart LR
  A["execute_suricata"] -- "calls" --> B["set_log_dir"]
  B -- "appends -l flag and log dir" --> C["vec_of_sur_cmd"]

Loading

File Walkthrough

	Relevant files
Bug fix	suricata.rs Pass user-configured log directory to Suricata command      src/suricata.rs Add new set_log_dir function that appends the -l flag and suriconf.log_dir path to the Suricata command arguments Call set_log_dir in execute_suricata during command construction, before get_capture_mode +6/-0

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Ensure user-configured log directory exists Suricata will fail to start if the user-configured log directory does not already exist on disk. Create the directory (including parents) before passing it via -l, and handle errors explicitly rather than silently continuing. src/suricata.rs [220-223] pub fn set_log_dir(suriconf: &Suriconf, vec_of_sur_cmd: &mut Vec<String>) { + if let Err(e) = std::fs::create_dir_all(&suriconf.log_dir) { + panic!("Failed to create log dir {}: {e}", suriconf.log_dir.display()); + } vec_of_sur_cmd.push("-l".to_string()); vec_of_sur_cmd.push(suriconf.log_dir.display().to_string()); } Suggestion importance[1-10]: 4 __ Why: Suricata does fail when the log directory does not exist, so creating it via std::fs::create_dir_all before appending the -l flag is a valid robustness improvement. However, the PR does not show whether the log directory is already guaranteed to exist elsewhere (e.g., when parsing suriconf.log_dir), and the suggested panic! error handling mirrors existing code style but limits the quality of the improvement.	Low
General	Guard against empty log directory If suriconf.log_dir is empty or unconfigured, pushing -l with an empty string will make Suricata fail or fall back to unexpected behavior. Skip adding the -l flags in that case so the default log directory is respected. src/suricata.rs [220-223] pub fn set_log_dir(suriconf: &Suriconf, vec_of_sur_cmd: &mut Vec<String>) { + if suriconf.log_dir.as_os_str().is_empty() { + return; + } vec_of_sur_cmd.push("-l".to_string()); vec_of_sur_cmd.push(suriconf.log_dir.display().to_string()); } Suggestion importance[1-10]: 3 __ Why: Guarding against an empty suriconf.log_dir is a plausible defensive check to avoid passing an empty -l argument to Suricata. It is speculative though, since the PR does not show how log_dir is constructed, and it may already be validated or defaulted in the configuration code.	Low

• Author self-review: I have reviewed the PR code suggestions, and addressed the relevant ones.