suricata
log-pcap.c File Reference
#include "suricata-common.h"
#include "util-fmemopen.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "util-unittest.h"
#include "log-pcap.h"
#include "decode-ipv4.h"
#include "util-error.h"
#include "util-debug.h"
#include "util-time.h"
#include "util-byte.h"
#include "util-misc.h"
#include "util-cpu.h"
#include "util-atomic.h"
#include "source-pcap.h"
#include "output.h"
#include "queue.h"
Include dependency graph for log-pcap.c:

Go to the source code of this file.

Data Structures

struct  PcapFileName_
 
struct  PcapLogProfileData_
 
struct  PcapLogCompressionData_
 
struct  PcapLogData_
 
struct  PcapLogThreadData_
 

Macros

#define DEFAULT_LOG_FILENAME   "pcaplog"
 
#define MODULE_NAME   "PcapLog"
 
#define MIN_LIMIT   4 * 1024 * 1024
 
#define DEFAULT_LIMIT   100 * 1024 * 1024
 
#define DEFAULT_FILE_LIMIT   0
 
#define LOGMODE_NORMAL   0
 
#define LOGMODE_SGUIL   1
 
#define LOGMODE_MULTI   2
 
#define RING_BUFFER_MODE_DISABLED   0
 
#define RING_BUFFER_MODE_ENABLED   1
 
#define TS_FORMAT_SEC   0
 
#define TS_FORMAT_USEC   1
 
#define USE_STREAM_DEPTH_DISABLED   0
 
#define USE_STREAM_DEPTH_ENABLED   1
 
#define HONOR_PASS_RULES_DISABLED   0
 
#define HONOR_PASS_RULES_ENABLED   1
 
#define PCAP_SNAPLEN   262144
 
#define MAX_TOKS   9
 
#define MAX_FILENAMELEN   513
 
#define PCAPLOG_PROFILE_START   uint64_t pcaplog_profile_ticks = UtilCpuGetTicks()
 
#define PCAPLOG_PROFILE_END(prof)
 

Typedefs

typedef struct PcapFileName_ PcapFileName
 
typedef struct PcapLogProfileData_ PcapLogProfileData
 
typedef struct PcapLogCompressionData_ PcapLogCompressionData
 
typedef struct PcapLogData_ PcapLogData
 
typedef struct PcapLogThreadData_ PcapLogThreadData
 

Enumerations

enum  PcapLogCompressionFormat { PCAP_LOG_COMPRESSION_FORMAT_NONE, PCAP_LOG_COMPRESSION_FORMAT_LZ4 }
 

Functions

 SC_ATOMIC_DECLARE (uint32_t, thread_cnt)
 
void PcapLogRegister (void)
 
void PcapLogProfileSetup (void)
 

Detailed Description

Author
William Metcalf Willi.nosp@m.am.M.nosp@m.etcal.nosp@m.f@gm.nosp@m.ail.c.nosp@m.om
Victor Julien victo.nosp@m.r@in.nosp@m.linia.nosp@m.c.ne.nosp@m.t

Pcap packet logging module.

Definition in file log-pcap.c.

Macro Definition Documentation

#define DEFAULT_FILE_LIMIT   0

Definition at line 72 of file log-pcap.c.

#define DEFAULT_LIMIT   100 * 1024 * 1024

Definition at line 71 of file log-pcap.c.

#define DEFAULT_LOG_FILENAME   "pcaplog"

Definition at line 68 of file log-pcap.c.

#define HONOR_PASS_RULES_DISABLED   0

Definition at line 87 of file log-pcap.c.

#define HONOR_PASS_RULES_ENABLED   1

Definition at line 88 of file log-pcap.c.

#define LOGMODE_MULTI   2

Definition at line 76 of file log-pcap.c.

#define LOGMODE_NORMAL   0

Definition at line 74 of file log-pcap.c.

#define LOGMODE_SGUIL   1

Definition at line 75 of file log-pcap.c.

#define MAX_FILENAMELEN   513

Definition at line 114 of file log-pcap.c.

#define MAX_TOKS   9

Definition at line 113 of file log-pcap.c.

#define MIN_LIMIT   4 * 1024 * 1024

Definition at line 70 of file log-pcap.c.

#define MODULE_NAME   "PcapLog"

Definition at line 69 of file log-pcap.c.

Referenced by PcapLogRegister().

#define PCAP_SNAPLEN   262144

Definition at line 90 of file log-pcap.c.

#define PCAPLOG_PROFILE_END (   prof)
Value:
(prof).total += (UtilCpuGetTicks() - pcaplog_profile_ticks); \
(prof).cnt++
uint64_t UtilCpuGetTicks(void)
Definition: util-cpu.c:183

Definition at line 218 of file log-pcap.c.

#define PCAPLOG_PROFILE_START   uint64_t pcaplog_profile_ticks = UtilCpuGetTicks()

Definition at line 215 of file log-pcap.c.

#define RING_BUFFER_MODE_DISABLED   0

Definition at line 78 of file log-pcap.c.

#define RING_BUFFER_MODE_ENABLED   1

Definition at line 79 of file log-pcap.c.

#define TS_FORMAT_SEC   0

Definition at line 81 of file log-pcap.c.

#define TS_FORMAT_USEC   1

Definition at line 82 of file log-pcap.c.

#define USE_STREAM_DEPTH_DISABLED   0

Definition at line 84 of file log-pcap.c.

#define USE_STREAM_DEPTH_ENABLED   1

Definition at line 85 of file log-pcap.c.

Typedef Documentation

typedef struct PcapFileName_ PcapFileName
typedef struct PcapLogData_ PcapLogData

PcapLog thread vars

Used for storing file options.

Enumeration Type Documentation

Enumerator
PCAP_LOG_COMPRESSION_FORMAT_NONE 
PCAP_LOG_COMPRESSION_FORMAT_LZ4 

Definition at line 116 of file log-pcap.c.

Function Documentation

void PcapLogProfileSetup ( void  )

Definition at line 1817 of file log-pcap.c.

References ConfGetNode(), ConfigGetLogDirectory(), ConfNodeChildValueIsTrue(), ConfNodeLookupChildValue(), ConfValIsTrue(), SC_ERR_MEM_ALLOC, SCLogError, SCLogInfo, SCMalloc, and unlikely.

Referenced by PcapLogRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void PcapLogRegister ( void  )

Definition at line 205 of file log-pcap.c.

References LOGGER_PCAP, MODULE_NAME, OutputRegisterPacketModule(), PcapLogProfileSetup(), and SC_ATOMIC_INIT.

Referenced by OutputRegisterLoggers().

Here is the call graph for this function:

Here is the caller graph for this function:

SC_ATOMIC_DECLARE ( uint32_t  ,
thread_cnt   
)