Go to the documentation of this file.
55 #define DEFAULT_ALERT_SYSLOG_FACILITY_STR "local0"
56 #define DEFAULT_ALERT_SYSLOG_FACILITY LOG_LOCAL0
57 #define DEFAULT_ALERT_SYSLOG_LEVEL LOG_ERR
58 #define MODULE_NAME "AlertSyslog"
73 static void AlertSyslogDeInitCtx(
OutputCtx *output_ctx)
75 if (output_ctx != NULL) {
77 if (logfile_ctx != NULL) {
95 if (facility_s == NULL) {
100 if (logfile_ctx == NULL) {
101 SCLogDebug(
"AlertSyslogInitCtx: Could not create new LogFileCtx");
106 if (facility == -1) {
108 " now using \"%s\" as syslog facility", facility_s,
114 if (level_s != NULL) {
117 alert_syslog_level = level;
125 openlog(ident, LOG_PID|LOG_NDELAY, facility);
133 memset(output_ctx, 0x00,
sizeof(
OutputCtx));
135 output_ctx->
data = logfile_ctx;
136 output_ctx->
DeInit = AlertSyslogDeInitCtx;
140 result.
ctx = output_ctx;
153 static TmEcode AlertSyslogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
155 if(initdata == NULL) {
156 SCLogDebug(
"Error getting context for AlertSyslog. \"initdata\" "
207 const char *action =
"";
230 char srcip[16], dstip[16];
241 syslog(alert_syslog_level,
"%s[%" PRIu32
":%" PRIu32
":%"
242 PRIu32
"] %s [Classification: %s] [Priority: %"PRIu32
"]"
243 " {%s} %s:%" PRIu32
" -> %s:%" PRIu32
"", action, pa->
s->
gid,
245 protoptr, srcip, p->
sp, dstip, p->
dp);
265 const char *action =
"";
287 char srcip[46], dstip[46];
298 syslog(alert_syslog_level,
"%s[%" PRIu32
":%" PRIu32
":%"
299 "" PRIu32
"] %s [Classification: %s] [Priority: %"
300 "" PRIu32
"] {%s} %s:%" PRIu32
" -> %s:%" PRIu32
"",
302 pa->
s->
prio, protoptr, srcip, p->
sp,
324 const char *action =
"";
331 char temp_buf_hdr[512];
332 char temp_buf_pkt[65] =
"";
333 char temp_buf_tail[64];
334 char alert[2048] =
"";
348 snprintf(temp_buf_hdr,
sizeof(temp_buf_hdr),
"%s[%" PRIu32
":%" PRIu32
349 ":%" PRIu32
"] %s [Classification: %s] [Priority: %" PRIu32
350 "] [**] [Raw pkt: ", action, pa->
s->
gid, pa->
s->
id, pa->
s->
rev, pa->
s->
msg,
352 strlcpy(alert, temp_buf_hdr,
sizeof(alert));
355 strlcat(alert, temp_buf_pkt,
sizeof(alert));
358 snprintf(temp_buf_tail,
sizeof(temp_buf_tail),
"] [pcap file packet: %"PRIu64
"]",
361 temp_buf_tail[0] =
']';
362 temp_buf_tail[1] =
'\0';
364 strlcat(alert, temp_buf_tail,
sizeof(alert));
366 syslog(alert_syslog_level,
"%s", alert);
381 return AlertSyslogIPv4(
tv, p, thread_data);
383 return AlertSyslogIPv6(
tv, p, thread_data);
385 return AlertSyslogDecoderEvent(
tv, p, thread_data);
398 AlertSyslogInitCtx, AlertSyslogLogger, AlertSyslogCondition,
399 AlertSyslogThreadInit, AlertSyslogThreadDeinit, NULL);
const struct Signature_ * s
#define syslog(__pri, __fmt, __param)
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
PacketAlert alerts[PACKET_ALERT_MAX]
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
#define IPV6_GET_L4PROTO(p)
#define GET_IPV6_DST_ADDR(p)
PacketEngineEvents events
size_t strlcpy(char *dst, const char *src, size_t siz)
#define IPV4_GET_IPPROTO(p)
#define GET_IPV4_DST_ADDR_PTR(p)
#define DEFAULT_ALERT_SYSLOG_LEVEL
size_t strlcat(char *, const char *src, size_t siz)
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
#define SCMutexUnlock(mut)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR
@ SC_ERR_INVALID_ARGUMENT
SCEnumCharMap * SCSyslogGetLogLevelMap(void)
returns the syslog facility enum map
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
#define GET_IPV4_SRC_ADDR_PTR(p)
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
void(* DeInit)(struct OutputCtx_ *)
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
#define GET_IPV6_SRC_ADDR(p)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
int EngineModeIsIPS(void)
struct AlertSyslogThread_ AlertSyslogThread
#define DEFAULT_ALERT_SYSLOG_FACILITY
#define openlog(__ident, __option, __facility)
void PrintRawLineHexBuf(char *retbuf, uint32_t retbuflen, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line in to retbuf buffer
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.