inliniac/suricata — pull request #1012 by giacomo83m (2014-07-02 22:17:52+00:00)
Title: Cef feature 1229 v3

Now the default behavior is to log application fields only when the correct state (PACKET_ALARM_FLAG_STATE_MATCH) is set in PacketAlarm::flags .
I’ve created the “applayer-fallback” option (disabled by default) to permit user to log layer 7 fields related to the session also when the alarm is not generated by a layer 7 signature.