Go to the documentation of this file.
59 #define DEFAULT_LOG_FILENAME "alert-debug.log"
61 #define MODULE_NAME "AlertDebugLog"
139 static int AlertDebugPrintStreamSegmentCallback(
140 const Packet *p,
TcpSegment *seg,
void *data,
const uint8_t *buf, uint32_t buflen)
158 const char *pkt_src_str = NULL;
168 "TIME: %s\n", timebuf);
175 char srcip[46], dstip[46];
187 "PROTO: %" PRIu32
"\n",
188 srcip, dstip, p->
proto);
191 "DST PORT: %" PRIu32
"\n",
195 "TCP ACK: %"PRIu32
"\n",
206 if (p->
flow != NULL) {
212 "FLOW PKTS TOSRC: %"PRIu32
"\n"
213 "FLOW Total Bytes: %"PRIu64
"\n",
217 "FLOW IPONLY SET: TOSERVER: %s, TOCLIENT: %s\n"
218 "FLOW ACTION: DROP: %s\n"
219 "FLOW NOINSPECTION: PACKET: %s, PAYLOAD: %s, APP_LAYER: %s\n"
220 "FLOW APP_LAYER: DETECTED: %s, PROTO %"PRIu16
"\n",
226 applayer ?
"TRUE" :
"FALSE",
228 AlertDebugLogFlowVars(aft, p);
231 AlertDebugLogPktVars(aft, p);
237 "PACKET LEN: %" PRIu32
"\n"
253 "ALERT MSG [%02d]: %s\n"
254 "ALERT GID [%02d]: %" PRIu32
"\n"
255 "ALERT SID [%02d]: %" PRIu32
"\n"
256 "ALERT REV [%02d]: %" PRIu32
"\n"
257 "ALERT CLASS [%02d]: %s\n"
258 "ALERT PRIO [%02d]: %" PRIu32
"\n"
259 "ALERT FOUND IN [%02d]: %s\n",
271 "ALERT IN TX [%02d]: %"PRIu64
"\n", i, pa->
tx_id);
274 "ALERT IN TX [%02d]: N/A\n", i);
278 "PAYLOAD LEN: %" PRIu32
"\n"
301 AlertDebugPrintStreamSegmentCallback,
320 const char *pkt_src_str = NULL;
330 "+================\n"
331 "TIME: %s\n", timebuf);
334 "PCAP PKT NUM: %"PRIu64
"\n", p->
pcap_cnt);
339 "ALERT CNT: %" PRIu32
"\n", p->
alerts.
cnt);
348 "ALERT MSG [%02d]: %s\n"
349 "ALERT GID [%02d]: %" PRIu32
"\n"
350 "ALERT SID [%02d]: %" PRIu32
"\n"
351 "ALERT REV [%02d]: %" PRIu32
"\n"
352 "ALERT CLASS [%02d]: %s\n"
353 "ALERT PRIO [%02d]: %" PRIu32
"\n",
363 "PACKET LEN: %" PRIu32
"\n"
375 static TmEcode AlertDebugLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
384 SCLogDebug(
"Error getting context for AlertDebugLog. \"initdata\" argument NULL");
393 if (aft->
buffer == NULL) {
417 static void AlertDebugLogDeInitCtx(
OutputCtx *output_ctx)
419 if (output_ctx != NULL) {
421 if (logfile_ctx != NULL) {
441 if (file_ctx == NULL) {
454 memset(output_ctx, 0x00,
sizeof(
OutputCtx));
455 output_ctx->
data = file_ctx;
456 output_ctx->
DeInit = AlertDebugLogDeInitCtx;
458 SCLogDebug(
"Alert debug log output initialized");
459 result.
ctx = output_ctx;
464 if (file_ctx != NULL) {
479 return AlertDebugLogger(
tv, p, thread_data);
481 return AlertDebugLogDecoderEvent(
tv, p, thread_data);
489 AlertDebugLogInitCtx, AlertDebugLogLogger, AlertDebugLogCondition,
490 AlertDebugLogThreadInit, AlertDebugLogThreadDeinit, NULL);
#define PACKET_ALERT_FLAG_STREAM_MATCH
const struct Signature_ * s
#define STREAM_DUMP_TOSERVER
#define PACKET_ALERT_FLAG_TX
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
int StreamSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
#define FLOW_NOPAYLOAD_INSPECTION
#define FLOW_PKT_TOSERVER
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
union FlowVar_::@110 data
#define GET_IPV6_DST_ADDR(p)
PacketEngineEvents events
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
int StreamTcpAppLayerIsDisabled(Flow *f)
struct GenericVar_ * next
void PrintRawDataToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, uint32_t src_buf_len)
#define GET_IPV4_DST_ADDR_PTR(p)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
const char * PktSrcToString(enum PktSrcEnum pkt_src)
#define FLOW_TOSERVER_IPONLY_SET
#define FLOW_PKT_TOCLIENT
#define DEFAULT_LOG_FILENAME
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
#define GET_IPV4_SRC_ADDR_PTR(p)
#define FLOW_TOCLIENT_IPONLY_SET
void(* DeInit)(struct OutputCtx_ *)
const char * VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
find name for id+type at packet time.
void MemBufferFree(MemBuffer *buffer)
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
#define GET_IPV6_SRC_ADDR(p)
#define STREAM_DUMP_TOCLIENT
struct AlertDebugLogThread_ AlertDebugLogThread
#define FLOW_NOPACKET_INSPECTION
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
void AlertDebugLogRegister(void)
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
AppProto alproto
application level protocol
#define PACKET_ALERT_FLAG_STATE_MATCH
#define DEBUG_VALIDATE_BUG_ON(exp)
void CreateTimeString(const SCTime_t ts, char *str, size_t size)
MemBuffer * MemBufferCreateNew(uint32_t size)