From 322c0b8d568e432b35970c2419353681e63a05d3 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 13 Mar 2026 15:14:19 -0400 Subject: [PATCH] Move pcap.enabled under suricata.pcap.enabled in so-minion --- salt/manager/tools/sbin/so-minion | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion index 417b1eaf3..2d5ef448e 100755 --- a/salt/manager/tools/sbin/so-minion +++ b/salt/manager/tools/sbin/so-minion @@ -462,19 +462,14 @@ function add_sensor_to_minion() { echo " lb_procs: '$CORECOUNT'" echo "suricata:" echo " enabled: True " + echo " pcap:" + echo " enabled: True" if [[ $is_pcaplimit ]]; then - echo " pcap:" echo " maxsize: $MAX_PCAP_SPACE" fi echo " config:" echo " af-packet:" echo " threads: '$CORECOUNT'" - echo "pcap:" - echo " enabled: True" - if [[ $is_pcaplimit ]]; then - echo " config:" - echo " diskfreepercentage: $DFREEPERCENT" - fi echo " " } >> $PILLARFILE if [ $? -ne 0 ]; then