suricata
alert-fastlog.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"
#include "threads.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-reference.h"
#include "util-classification-config.h"
#include "output.h"
#include "alert-fastlog.h"
#include "util-privs.h"
#include "util-print.h"
#include "util-proto-name.h"
#include "util-optimize.h"
#include "util-logopenfile.h"
#include "util-time.h"
Include dependency graph for alert-fastlog.c:

Go to the source code of this file.

Data Structures

struct  AlertFastLogThread_
 

Macros

#define DEFAULT_LOG_FILENAME   "fast.log"
 
#define MODULE_NAME   "AlertFastLog"
 
#define MAX_FASTLOG_ALERT_SIZE   2048
 
#define MAX_FASTLOG_BUFFER_SIZE   (2 * MAX_FASTLOG_ALERT_SIZE)
 

Typedefs

typedef struct AlertFastLogThread_ AlertFastLogThread
 

Functions

TmEcode AlertFastLogThreadInit (ThreadVars *, const void *, void **)
 
TmEcode AlertFastLogThreadDeinit (ThreadVars *, void *)
 
void AlertFastLogRegisterTests (void)
 This function registers unit tests for AlertFastLog API. More...
 
int AlertFastLogCondition (ThreadVars *tv, const Packet *p)
 
int AlertFastLogger (ThreadVars *tv, void *data, const Packet *p)
 
void AlertFastLogRegister (void)
 
OutputInitResult AlertFastLogInitCtx (ConfNode *conf)
 Create a new LogFileCtx for "fast" output style. More...
 

Detailed Description

Author
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Logs alerts in a line based text format compatible to Snort's alert_fast format.

Todo:

Support classifications

Support more than just IPv4/IPv6 TCP/UDP.

Definition in file alert-fastlog.c.

Macro Definition Documentation

#define DEFAULT_LOG_FILENAME   "fast.log"

Definition at line 60 of file alert-fastlog.c.

Referenced by AlertFastLogInitCtx().

#define MAX_FASTLOG_ALERT_SIZE   2048

Definition at line 65 of file alert-fastlog.c.

Referenced by AlertFastLogger().

#define MAX_FASTLOG_BUFFER_SIZE   (2 * MAX_FASTLOG_ALERT_SIZE)

Definition at line 68 of file alert-fastlog.c.

Referenced by AlertFastLogger().

#define MODULE_NAME   "AlertFastLog"

Definition at line 62 of file alert-fastlog.c.

Referenced by AlertFastLogRegister().

Typedef Documentation

Function Documentation

int AlertFastLogCondition ( ThreadVars tv,
const Packet p 
)

Definition at line 91 of file alert-fastlog.c.

References Packet_::alerts, PacketAlerts_::cnt, FALSE, AlertFastLogThread_::file_ctx, TRUE, and LogFileCtx_::Write.

Referenced by AlertFastLogRegister().

Here is the caller graph for this function:

void AlertFastLogRegister ( void  )

Definition at line 78 of file alert-fastlog.c.

References AlertFastLogCondition(), AlertFastLogger(), AlertFastLogInitCtx(), AlertFastLogRegisterTests(), AlertFastLogThreadDeinit(), AlertFastLogThreadInit(), LOGGER_ALERT_FAST, MODULE_NAME, and OutputRegisterPacketModule().

Referenced by OutputRegisterLoggers().

Here is the call graph for this function:

Here is the caller graph for this function:

void AlertFastLogRegisterTests ( void  )

This function registers unit tests for AlertFastLog API.

Definition at line 360 of file alert-fastlog.c.

References UtRegisterTest().

Referenced by AlertFastLogRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode AlertFastLogThreadDeinit ( ThreadVars t,
void *  data 
)

Definition at line 207 of file alert-fastlog.c.

References SCFree, and TM_ECODE_OK.

Referenced by AlertFastLogRegister().

Here is the caller graph for this function:

TmEcode AlertFastLogThreadInit ( ThreadVars t,
const void *  initdata,
void **  data 
)

Use the Ouptut Context (file pointer and mutex)

Definition at line 188 of file alert-fastlog.c.

References AlertFastLogThread_::file_ctx, SCFree, SCLogDebug, SCMalloc, TM_ECODE_FAILED, TM_ECODE_OK, and unlikely.

Referenced by AlertFastLogRegister().

Here is the caller graph for this function: