Go to the documentation of this file.
55 #define MODULE_NAME "AlertSyslog"
70 static void AlertSyslogDeInitCtx(
OutputCtx *output_ctx)
72 if (output_ctx != NULL) {
74 if (logfile_ctx != NULL) {
92 if (facility_s == NULL) {
97 if (logfile_ctx == NULL) {
98 SCLogDebug(
"AlertSyslogInitCtx: Could not create new LogFileCtx");
103 if (facility == -1) {
105 " now using \"%s\" as syslog facility",
111 if (level_s != NULL) {
114 alert_syslog_level = level;
122 openlog(ident, LOG_PID|LOG_NDELAY, facility);
131 output_ctx->
data = logfile_ctx;
132 output_ctx->
DeInit = AlertSyslogDeInitCtx;
136 result.
ctx = output_ctx;
149 static TmEcode AlertSyslogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
151 if(initdata == NULL) {
152 SCLogDebug(
"Error getting context for AlertSyslog. \"initdata\" "
200 const char *action =
"";
206 const char *protoptr;
211 snprintf(
proto,
sizeof(
proto),
"PROTO:%03" PRIu8, ipproto);
215 char srcip[16], dstip[16];
219 for (
int i = 0; i < p->
alerts.
cnt; i++) {
233 syslog(alert_syslog_level,
"%s[%" PRIu32
":%" PRIu32
":%"
234 PRIu32
"] %s [Classification: %s] [Priority: %"PRIu32
"]"
235 " {%s} %s:%" PRIu32
" -> %s:%" PRIu32
"", action, pa->
s->
gid,
237 protoptr, srcip, p->
sp, dstip, p->
dp);
256 const char *action =
"";
262 const char *protoptr;
267 snprintf(
proto,
sizeof(
proto),
"PROTO:03%" PRIu8, ipproto);
271 char srcip[46], dstip[46];
275 for (
int i = 0; i < p->
alerts.
cnt; i++) {
288 syslog(alert_syslog_level,
"%s[%" PRIu32
":%" PRIu32
":%"
289 "" PRIu32
"] %s [Classification: %s] [Priority: %"
290 "" PRIu32
"] {%s} %s:%" PRIu32
" -> %s:%" PRIu32
"",
292 pa->
s->
prio, protoptr, srcip, p->
sp,
312 const char *action =
"";
317 char temp_buf_hdr[512];
318 char temp_buf_pkt[65] =
"";
319 char temp_buf_tail[64];
320 char alert[2048] =
"";
322 for (
int i = 0; i < p->
alerts.
cnt; i++) {
334 snprintf(temp_buf_hdr,
sizeof(temp_buf_hdr),
"%s[%" PRIu32
":%" PRIu32
335 ":%" PRIu32
"] %s [Classification: %s] [Priority: %" PRIu32
336 "] [**] [Raw pkt: ", action, pa->
s->
gid, pa->
s->
id, pa->
s->
rev, pa->
s->
msg,
338 strlcpy(alert, temp_buf_hdr,
sizeof(alert));
341 strlcat(alert, temp_buf_pkt,
sizeof(alert));
344 snprintf(temp_buf_tail,
sizeof(temp_buf_tail),
"] [pcap file packet: %"PRIu64
"]",
347 temp_buf_tail[0] =
']';
348 temp_buf_tail[1] =
'\0';
350 strlcat(alert, temp_buf_tail,
sizeof(alert));
353 syslog(alert_syslog_level,
"%s", alert);
368 return AlertSyslogIPv4(
tv, p, thread_data);
370 return AlertSyslogIPv6(
tv, p, thread_data);
372 return AlertSyslogDecoderEvent(
tv, p, thread_data);
385 AlertSyslogInitCtx, AlertSyslogLogger, AlertSyslogCondition,
386 AlertSyslogThreadInit, AlertSyslogThreadDeinit, NULL);
const struct Signature_ * s
#define syslog(__pri, __fmt, __param)
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
#define IPV6_GET_L4PROTO(p)
const char * known_proto[256]
#define GET_IPV6_DST_ADDR(p)
PacketEngineEvents events
#define DEFAULT_ALERT_SYSLOG_FACILITY
size_t strlcpy(char *dst, const char *src, size_t siz)
#define DEFAULT_ALERT_SYSLOG_LEVEL
#define IPV4_GET_IPPROTO(p)
#define GET_IPV4_DST_ADDR_PTR(p)
size_t strlcat(char *, const char *src, size_t siz)
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
#define SCMutexUnlock(mut)
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define SCLogWarning(...)
Macro used to log WARNING messages.
SCEnumCharMap * SCSyslogGetLogLevelMap(void)
returns the syslog facility enum map
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define GET_IPV4_SRC_ADDR_PTR(p)
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
void(* DeInit)(struct OutputCtx_ *)
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
#define GET_IPV6_SRC_ADDR(p)
int EngineModeIsIPS(void)
struct AlertSyslogThread_ AlertSyslogThread
#define openlog(__ident, __option, __facility)
void PrintRawLineHexBuf(char *retbuf, uint32_t retbuflen, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line into retbuf buffer
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.