diff --git a/scripts/policy/frameworks/storage/backend/redis/main.zeek b/scripts/policy/frameworks/storage/backend/redis/main.zeek index 09746eddfb..413c201083 100644 --- a/scripts/policy/frameworks/storage/backend/redis/main.zeek +++ b/scripts/policy/frameworks/storage/backend/redis/main.zeek @@ -32,6 +32,6 @@ export { # and the backend will be forced into synchronous mode, since # time won't move forward the same as when capturing live # traffic. - async_mode: bool &default=F; + async_mode: bool &default=T; }; } diff --git a/src/storage/backend/redis/Redis.cc b/src/storage/backend/redis/Redis.cc index 40e6397ed0..29a893d704 100644 --- a/src/storage/backend/redis/Redis.cc +++ b/src/storage/backend/redis/Redis.cc @@ -88,7 +88,9 @@ storage::BackendPtr Redis::Instantiate(std::string_view tag) { return make_intru * with a corresponding message. */ ErrorResult Redis::DoOpen(RecordValPtr options) { - async_mode = options->GetField("async_mode")->Get(); + // When reading traces we disable storage async mode globally (see src/storage/Backend.cc) since + // time moves forward based on the pcap and not based on real time. + async_mode = options->GetField("async_mode")->Get() && ! zeek::run_state::reading_traces; key_prefix = options->GetField("key_prefix")->ToStdString(); redisOptions opt = {0};