33 #if defined(HAVE_DIRENT_H) && defined(HAVE_FNMATCH_H)
34 #define INIT_RING_BUFFER
58 #define DEFAULT_LOG_FILENAME "pcaplog"
59 #define MODULE_NAME "PcapLog"
60 #define MIN_LIMIT 4 * 1024 * 1024
61 #define DEFAULT_LIMIT 100 * 1024 * 1024
62 #define DEFAULT_FILE_LIMIT 0
64 #define LOGMODE_NORMAL 0
65 #define LOGMODE_MULTI 1
73 #define RING_BUFFER_MODE_DISABLED 0
74 #define RING_BUFFER_MODE_ENABLED 1
76 #define TS_FORMAT_SEC 0
77 #define TS_FORMAT_USEC 1
79 #define USE_STREAM_DEPTH_DISABLED 0
80 #define USE_STREAM_DEPTH_ENABLED 1
82 #define HONOR_PASS_RULES_DISABLED 0
83 #define HONOR_PASS_RULES_ENABLED 1
85 #define PCAP_SNAPLEN 262144
86 #define PCAP_BUFFER_TIMEOUT 1000000 // microseconds
87 #define PCAP_PKTHDR_SIZE 16
90 #ifndef PCAP_NETMASK_UNKNOWN
91 #define PCAP_NETMASK_UNKNOWN 0xffffffff
118 #define MAX_FILENAMELEN 513
130 LZ4F_compressionContext_t lz4f_context;
131 LZ4F_preferences_t lz4f_prefs;
151 struct pcap_pkthdr *
h;
177 uint32_t thread_number;
179 int timestamp_format;
186 int filename_part_cnt;
187 struct timeval last_pcap_dump;
202 static const char timestamp_pattern[] =
".*?(\\d+)(\\.(\\d+))?";
203 static pcre2_code *pcre_timestamp_code = NULL;
204 static pcre2_match_data *pcre_timestamp_match = NULL;
214 static void PcapLogFileDeInitCtx(
OutputCtx *);
224 .ConditionFunc = PcapLogCondition,
225 .ThreadInitFunc = PcapLogDataInit,
226 .ThreadDeinitFunc = PcapLogDataDeinit,
227 .ThreadExitPrintStatsFunc = NULL,
236 #define PCAPLOG_PROFILE_START \
237 uint64_t pcaplog_profile_ticks = UtilCpuGetTicks()
239 #define PCAPLOG_PROFILE_END(prof) \
240 (prof).total += (UtilCpuGetTicks() - pcaplog_profile_ticks); \
289 SCLogError(
"SCFmemopen failed: %s", strerror(errno));
308 uint64_t bytes_written = LZ4F_compressEnd(comp->lz4f_context,
310 if (LZ4F_isError(bytes_written)) {
311 SCLogError(
"LZ4F_compressEnd: %s", LZ4F_getErrorName(bytes_written));
314 if (fwrite(comp->
buffer, 1, bytes_written, comp->
file) < bytes_written) {
315 SCLogError(
"fwrite failed: %s", strerror(errno));
357 if (PcapLogCloseFile(t,pl) < 0) {
373 PcapFileNameFree(pf);
377 if (PcapLogOpenFileCtx(pl) < 0) {
378 SCLogError(
"opening new pcap log file failed");
398 SCLogDebug(
"Setting pcap-log link type to %u", datalink);
405 struct bpf_program bpfp;
412 if (pl->
bpfp == NULL) {
413 FatalError(
"Failed to allocate memory for BPF filter, aborting");
424 if (!pl->pcap_open_err) {
426 pl->pcap_open_err =
true;
430 pl->pcap_open_err =
false;
438 if (comp->
file == NULL) {
439 if (errno != pl->fopen_err) {
440 SCLogError(
"Error opening file for compressed output: %s", strerror(errno));
441 pl->fopen_err = errno;
450 if (!pl->pcap_open_err) {
452 pl->pcap_open_err =
true;
458 pl->pcap_open_err =
false;
461 uint64_t bytes_written = LZ4F_compressBegin(comp->lz4f_context,
463 if (LZ4F_isError(bytes_written)) {
464 SCLogError(
"LZ4F_compressBegin: %s", LZ4F_getErrorName(bytes_written));
467 if (fwrite(comp->
buffer, 1, bytes_written, comp->
file) < bytes_written) {
468 SCLogError(
"fwrite failed: %s", strerror(errno));
505 static inline int PcapWrite(
508 struct timeval current_dump;
509 gettimeofday(¤t_dump, NULL);
513 if (pcap_offline_filter(pl->
bpfp, pl->
h, data) == 0) {
514 SCLogDebug(
"Packet doesn't match filter, will not be logged.");
532 SCLogError(
"ftell failed with: %s", strerror(errno));
535 uint64_t out_size = LZ4F_compressUpdate(comp->lz4f_context, comp->
buffer, comp->
buffer_size,
536 comp->
pcap_buf, (uint64_t)in_size, NULL);
537 if (LZ4F_isError(
len)) {
538 SCLogError(
"LZ4F_compressUpdate: %s", LZ4F_getErrorName(
len));
542 SCLogError(
"fseek failed: %s", strerror(errno));
545 if (fwrite(comp->
buffer, 1, out_size, comp->
file) < out_size) {
546 SCLogError(
"fwrite failed: %s", strerror(errno));
560 pl->last_pcap_dump = current_dump;
569 static int PcapLogSegmentCallback(
570 const Packet *p,
TcpSegment *seg,
void *data,
const uint8_t *buf, uint32_t buflen)
581 MemBufferReset(pctx->
td->
buf);
641 ret = PcapLogOpenFileCtx(pl);
652 if (PcapLogRotateFile(
tv, pl) < 0) {
668 if (PcapLogRotateFile(
tv, pl) < 0) {
691 if (PacketIsTCP(p)) {
693 PcapLogDumpSegments(
tv,
td, p);
731 SCLogDebug(
"pl->size_current %"PRIu64
", pl->size_limit %"PRIu64,
752 copy->prefix =
SCStrdup(pl->prefix);
753 if (
unlikely(copy->prefix == NULL)) {
759 copy->suffix = pl->suffix;
765 copy->use_ringbuffer = pl->use_ringbuffer;
766 copy->timestamp_format = pl->timestamp_format;
781 copy_comp->lz4f_prefs = comp->lz4f_prefs;
786 if (copy_comp->
buffer == NULL) {
787 SCLogError(
"SCMalloc failed: %s", strerror(errno));
795 SCLogError(
"SCMalloc failed: %s", strerror(errno));
805 SCLogError(
"SCFmemopen failed: %s", strerror(errno));
816 LZ4F_errorCode_t errcode =
817 LZ4F_createCompressionContext(©_comp->lz4f_context, 1);
818 if (LZ4F_isError(errcode)) {
819 SCLogError(
"LZ4F_createCompressionContext failed: %s", LZ4F_getErrorName(errcode));
831 copy_comp->
file = NULL;
839 strlcpy(copy->dir, pl->dir,
sizeof(copy->dir));
841 for (
int i = 0; i < pl->filename_part_cnt && i <
MAX_TOKS; i++)
842 copy->filename_parts[i] = pl->filename_parts[i];
843 copy->filename_part_cnt = pl->filename_part_cnt;
852 #ifdef INIT_RING_BUFFER
853 static int PcapLogGetTimeOfFile(
const char *filename, uint64_t *secs,
859 int n = pcre2_match(pcre_timestamp_code, (PCRE2_SPTR8)filename, strlen(filename), 0, 0,
860 pcre_timestamp_match, NULL);
861 if (n != 2 && n != 4) {
868 copylen =
sizeof(buf);
869 if (pcre2_substring_copy_bynumber(pcre_timestamp_match, 1, (PCRE2_UCHAR8 *)buf, ©len) <
879 copylen =
sizeof(buf);
880 if (pcre2_substring_copy_bynumber(pcre_timestamp_match, 3, (PCRE2_UCHAR8 *)buf, ©len) <
894 char pattern[PATH_MAX];
896 SCLogInfo(
"Initializing PCAP ring buffer for %s/%s.",
897 pl->dir, pl->prefix);
899 strlcpy(pattern, pl->dir, PATH_MAX);
900 if (pattern[strlen(pattern) - 1] !=
'/') {
901 strlcat(pattern,
"/", PATH_MAX);
904 for (
int i = 0; i < pl->filename_part_cnt; i++) {
905 char *part = pl->filename_parts[i];
906 if (part == NULL || strlen(part) == 0) {
909 if (part[0] !=
'%' || strlen(part) < 2) {
910 strlcat(pattern, part, PATH_MAX);
915 SCLogError(
"Thread ID not allowed in ring buffer mode.");
919 snprintf(tmp, PATH_MAX,
"%"PRIu32, pl->thread_number);
920 strlcat(pattern, tmp, PATH_MAX);
924 strlcat(pattern,
"*", PATH_MAX);
927 SCLogError(
"Unsupported format character: %%%s", part);
932 strlcat(pattern, pl->prefix, PATH_MAX);
933 strlcat(pattern,
".*", PATH_MAX);
935 strlcat(pattern, pl->suffix, PATH_MAX);
937 char *basename = strrchr(pattern,
'/');
941 DIR *dir = opendir(pattern);
943 SCLogWarning(
"Failed to open directory %s: %s", pattern, strerror(errno));
948 struct dirent *entry = readdir(dir);
952 if (fnmatch(basename, entry->d_name, 0) != 0) {
959 if (!PcapLogGetTimeOfFile(entry->d_name, &secs, &usecs)) {
970 if (snprintf(path, PATH_MAX,
"%s/%s", pattern, entry->d_name) == PATH_MAX)
1025 PcapFileNameFree(pf);
1041 static TmEcode PcapLogDataInit(
ThreadVars *t,
const void *initdata,
void **data)
1043 if (initdata == NULL) {
1044 SCLogDebug(
"Error getting context for LogPcap. \"initdata\" argument NULL");
1058 td->
pcap_log = PcapLogDataCopy(pl);
1065 FatalError(
"Pcap logging with multiple link type is not supported.");
1076 FatalError(
"Can't have multiple link types in pcap conditional mode.");
1079 SCLogWarning(
"Using multiple link types can result in invalid pcap output");
1115 #ifdef INIT_RING_BUFFER
1120 SCLogInfo(
"Unable to initialize ring buffer on this platform.");
1131 PcapLogOpenFileCtx(pl);
1141 dst->profile_open.total +=
src->profile_open.total;
1142 dst->profile_open.cnt +=
src->profile_open.cnt;
1144 dst->profile_close.total +=
src->profile_close.total;
1145 dst->profile_close.cnt +=
src->profile_close.cnt;
1147 dst->profile_write.total +=
src->profile_write.total;
1148 dst->profile_write.cnt +=
src->profile_write.cnt;
1150 dst->profile_rotate.total +=
src->profile_rotate.total;
1151 dst->profile_rotate.cnt +=
src->profile_rotate.cnt;
1153 dst->profile_handles.total +=
src->profile_handles.total;
1154 dst->profile_handles.cnt +=
src->profile_handles.cnt;
1156 dst->profile_lock.total +=
src->profile_lock.total;
1157 dst->profile_lock.cnt +=
src->profile_lock.cnt;
1159 dst->profile_unlock.total +=
src->profile_unlock.total;
1160 dst->profile_unlock.cnt +=
src->profile_unlock.cnt;
1162 dst->profile_data_size +=
src->profile_data_size;
1169 while ((pf =
TAILQ_FIRST(&pl->pcap_file_list)) != NULL) {
1171 PcapFileNameFree(pf);
1173 if (pl == g_pcap_data) {
1174 for (
int i = 0; i <
MAX_TOKS; i++) {
1175 if (pl->filename_parts[i] != NULL) {
1176 SCFree(pl->filename_parts[i]);
1189 pcap_freecode(pl->
bpfp);
1195 SCFree(pl->compression.buffer);
1196 fclose(pl->compression.pcap_buf_wrapper);
1197 SCFree(pl->compression.pcap_buf);
1198 LZ4F_errorCode_t errcode =
1199 LZ4F_freeCompressionContext(pl->compression.lz4f_context);
1200 if (LZ4F_isError(errcode)) {
1222 if (PcapLogCloseFile(t,pl) < 0) {
1229 StatsMerge(g_pcap_data, pl);
1230 g_pcap_data->reported++;
1231 if (g_pcap_data->threads == g_pcap_data->reported)
1232 PcapLogProfilingDump(g_pcap_data);
1235 if (pl->reported == 0) {
1236 PcapLogProfilingDump(pl);
1241 if (pl != g_pcap_data) {
1242 PcapLogDataFree(pl);
1253 static int ParseFilename(
PcapLogData *pl,
const char *filename)
1260 size_t filename_len = 0;
1263 filename_len = strlen(filename);
1269 for (
int i = 0; i < (int)strlen(filename); i++) {
1271 SCLogError(
"invalid filename option. Max 2 %%-sign options");
1275 str[s++] = filename[i];
1277 if (filename[i] ==
'%') {
1288 if (i+1 < (
int)strlen(filename)) {
1290 SCLogError(
"invalid filename option. Max 2 %%-sign options");
1294 if (filename[i+1] !=
'n' && filename[i+1] !=
't' && filename[i+1] !=
'i') {
1296 "invalid filename option. Valid %%-sign options: %%n, %%i and %%t");
1300 str[1] = filename[i+1];
1312 SCLogError(
"Invalid filename for multimode. Need at least one %%-sign option");
1318 SCLogError(
"invalid filename option. Max 3 %%-sign options");
1330 for (
int i = 0; i < tok; i++) {
1331 if (toks[i] == NULL)
1335 pl->filename_parts[i] = toks[i];
1337 pl->filename_part_cnt = tok;
1341 for (
int x = 0; x <
MAX_TOKS; x++) {
1342 if (toks[x] != NULL)
1359 FatalError(
"A pcap-log instance is already active, only one can be enabled.");
1364 FatalError(
"Failed to allocate Memory for PcapLogData");
1368 if (pl->
h == NULL) {
1369 FatalError(
"Failed to allocate Memory for pcap header struct");
1386 pcre_timestamp_code =
1387 pcre2_compile((PCRE2_SPTR8)timestamp_pattern, PCRE2_ZERO_TERMINATED, 0, &en, &eo, NULL);
1388 if (pcre_timestamp_code == NULL) {
1389 PCRE2_UCHAR errbuffer[256];
1390 pcre2_get_error_message(en, errbuffer,
sizeof(errbuffer));
1392 "Failed to compile \"%s\" at offset %d: %s", timestamp_pattern, (
int)eo, errbuffer);
1394 pcre_timestamp_match = pcre2_match_data_create_from_pattern(pcre_timestamp_code, NULL);
1398 const char *filename = NULL;
1404 if (filename == NULL)
1407 if ((pl->prefix =
SCStrdup(filename)) == NULL) {
1415 const char *s_limit = NULL;
1417 if (s_limit != NULL) {
1419 SCLogError(
"Failed to initialize pcap output, invalid limit: %s", s_limit);
1423 SCLogInfo(
"pcap-log \"limit\" value of %"PRIu64
" assumed to be pre-1.2 "
1425 uint64_t size = pl->
size_limit * 1024 * 1024;
1428 FatalError(
"Fail to initialize pcap-log output, limit less than "
1429 "allowed minimum of %d bytes.",
1436 const char *s_mode = NULL;
1438 if (s_mode != NULL) {
1439 if (strcasecmp(s_mode,
"multi") == 0) {
1441 }
else if (strcasecmp(s_mode,
"normal") != 0) {
1442 FatalError(
"log-pcap: invalid mode \"%s\". Valid options: \"normal\""
1443 "or \"multi\" mode ",
1448 const char *s_dir = NULL;
1450 if (s_dir == NULL) {
1451 const char *log_dir = NULL;
1454 strlcpy(pl->dir, log_dir,
sizeof(pl->dir));
1459 s_dir,
sizeof(pl->dir));
1461 const char *log_dir = NULL;
1464 snprintf(pl->dir,
sizeof(pl->dir),
"%s/%s",
1468 struct stat stat_buf;
1469 if (stat(pl->dir, &stat_buf) != 0) {
1471 "supplied doesn't exist. Shutting down the engine",
1480 if (compression_str == NULL || strcmp(compression_str,
"none") == 0) {
1488 }
else if (strcmp(compression_str,
"lz4") == 0) {
1498 SCLogError(
"SCMalloc failed: %s", strerror(errno));
1504 SCLogError(
"SCFmemopen failed: %s", strerror(errno));
1510 memset(&comp->lz4f_prefs,
'\0',
sizeof(comp->lz4f_prefs));
1511 comp->lz4f_prefs.frameInfo.blockSizeID = LZ4F_max4MB;
1512 comp->lz4f_prefs.frameInfo.blockMode = LZ4F_blockLinked;
1514 comp->lz4f_prefs.frameInfo.contentChecksumFlag = 1;
1516 comp->lz4f_prefs.frameInfo.contentChecksumFlag = 0;
1522 }
else if (lvl < 0) {
1528 comp->lz4f_prefs.compressionLevel = (int)lvl;
1532 LZ4F_errorCode_t errcode =
1533 LZ4F_createCompressionContext(&pl->compression.lz4f_context, 1);
1535 if (LZ4F_isError(errcode)) {
1536 SCLogError(
"LZ4F_createCompressionContext failed: %s", LZ4F_getErrorName(errcode));
1548 "lz4 output buffer.");
1555 pl->suffix =
".lz4";
1558 "in pcap-log, but suricata was not compiled with lz4 "
1560 PcapLogDataFree(pl);
1566 "compression format: %s",
1568 PcapLogDataFree(pl);
1572 SCLogInfo(
"Selected pcap-log compression method: %s",
1573 compression_str ? compression_str :
"none");
1576 if (s_conditional != NULL) {
1577 if (strcasecmp(s_conditional,
"alerts") == 0) {
1580 }
else if (strcasecmp(s_conditional,
"tag") == 0) {
1583 }
else if (strcasecmp(s_conditional,
"all") != 0) {
1584 FatalError(
"log-pcap: invalid conditional \"%s\". Valid options: \"all\", "
1585 "\"alerts\", or \"tag\" mode ",
1591 "Selected pcap-log conditional logging: %s", s_conditional ? s_conditional :
"all");
1594 if (ParseFilename(pl, filename) != 0)
1601 const char *max_number_of_files_s = NULL;
1603 if (max_number_of_files_s != NULL) {
1605 max_number_of_files_s) == -1) {
1607 "pcap-log output, invalid number of files limit: %s",
1608 max_number_of_files_s);
1610 }
else if (max_file_limit < 1) {
1611 FatalError(
"Failed to initialize pcap-log output, limit less than "
1612 "allowed minimum.");
1620 const char *ts_format = NULL;
1624 if (ts_format != NULL) {
1625 if (strcasecmp(ts_format,
"usec") == 0) {
1627 }
else if (strcasecmp(ts_format,
"sec") != 0) {
1628 SCLogError(
"log-pcap ts_format specified %s is invalid must be"
1629 " \"sec\" or \"usec\"",
1635 const char *use_stream_depth = NULL;
1639 if (use_stream_depth != NULL) {
1645 FatalError(
"log-pcap use_stream_depth specified is invalid must be");
1649 const char *honor_pass_rules = NULL;
1653 if (honor_pass_rules != NULL) {
1659 FatalError(
"log-pcap honor-pass-rules specified is invalid");
1668 if (
unlikely(output_ctx == NULL)) {
1669 FatalError(
"Failed to allocate memory for OutputCtx.");
1671 output_ctx->
data = pl;
1672 output_ctx->
DeInit = PcapLogFileDeInitCtx;
1675 result.
ctx = output_ctx;
1680 static void PcapLogFileDeInitCtx(
OutputCtx *output_ctx)
1682 if (output_ctx == NULL)
1691 PcapLogDataFree(pl);
1694 pcre2_code_free(pcre_timestamp_code);
1695 pcre2_match_data_free(pcre_timestamp_match);
1708 char *filename = NULL;
1735 ret = snprintf(filename, PATH_MAX,
"%s/%s.%" PRIu32
"%s", pl->dir, pl->prefix,
1738 ret = snprintf(filename, PATH_MAX,
"%s/%s.%" PRIu32
".%" PRIu32
"%s", pl->dir,
1741 if (ret < 0 || (
size_t)ret >= PATH_MAX) {
1746 if (pl->filename_part_cnt > 0) {
1749 strlcpy(filename, pl->dir, PATH_MAX);
1750 strlcat(filename,
"/", PATH_MAX);
1752 for (
int i = 0; i < pl->filename_part_cnt; i++) {
1753 if (pl->filename_parts[i] == NULL ||strlen(pl->filename_parts[i]) == 0)
1757 if (pl->filename_parts[i][0] ==
'%') {
1759 if (strlen(pl->filename_parts[i]) < 2)
1762 switch(pl->filename_parts[i][1]) {
1764 snprintf(
str,
sizeof(
str),
"%u", pl->thread_number);
1769 snprintf(
str,
sizeof(
str),
"%"PRIu64, (uint64_t)thread_id);
1777 snprintf(
str,
sizeof(
str),
"%" PRIu32
".%" PRIu32,
1785 strlcat(filename, pl->filename_parts[i], PATH_MAX);
1788 strlcat(filename, pl->suffix, PATH_MAX);
1793 ret = snprintf(filename, PATH_MAX,
"%s/%s.%u.%" PRIu32
"%s", pl->dir, pl->prefix,
1796 ret = snprintf(filename, PATH_MAX,
"%s/%s.%u.%" PRIu32
".%" PRIu32
"%s", pl->dir,
1800 if (ret < 0 || (
size_t)ret >= PATH_MAX) {
1805 SCLogDebug(
"multi-mode: filename %s", filename);
1809 SCLogError(
"Error allocating memory. For filename");
1822 PcapFileNameFree(pf);
1835 static int profiling_pcaplog_enabled = 0;
1836 static int profiling_pcaplog_output_to_file = 0;
1837 static char *profiling_pcaplog_file_name = NULL;
1838 static const char *profiling_pcaplog_file_mode =
"a";
1840 static void FormatNumber(uint64_t num,
char *
str,
size_t size)
1843 snprintf(
str, size,
"%"PRIu64, num);
1844 else if (num < 1000000UL)
1845 snprintf(
str, size,
"%3.1fk", (
float)num/1000UL);
1846 else if (num < 1000000000UL)
1847 snprintf(
str, size,
"%3.1fm", (
float)num/1000000UL);
1849 snprintf(
str, size,
"%3.1fb", (
float)num/1000000000UL);
1854 char ticks_str[32] =
"n/a";
1855 char cnt_str[32] =
"n/a";
1856 char avg_str[32] =
"n/a";
1858 FormatNumber((uint64_t)p->
cnt, cnt_str,
sizeof(cnt_str));
1859 FormatNumber((uint64_t)p->
total, ticks_str,
sizeof(ticks_str));
1861 FormatNumber((uint64_t)(p->
total/p->
cnt), avg_str,
sizeof(avg_str));
1863 fprintf(fp,
"%-28s %-10s %-10s %-10s\n",
name, cnt_str, avg_str, ticks_str);
1866 static void ProfileReport(FILE *fp,
PcapLogData *pl)
1871 ProfileReportPair(fp,
"rotate (incl open/close)", &pl->
profile_rotate);
1877 static void FormatBytes(uint64_t num,
char *
str,
size_t size)
1880 snprintf(
str, size,
"%"PRIu64, num);
1881 else if (num < 1048576UL)
1882 snprintf(
str, size,
"%3.1fKiB", (
float)num/1000UL);
1883 else if (num < 1073741824UL)
1884 snprintf(
str, size,
"%3.1fMiB", (
float)num/1000000UL);
1886 snprintf(
str, size,
"%3.1fGiB", (
float)num/1000000000UL);
1893 if (profiling_pcaplog_enabled == 0)
1896 if (profiling_pcaplog_output_to_file == 1) {
1897 fp = fopen(profiling_pcaplog_file_name, profiling_pcaplog_file_mode);
1899 SCLogError(
"failed to open %s: %s", profiling_pcaplog_file_name, strerror(errno));
1907 fprintf(fp,
"\n\nOperation Cnt Avg ticks Total ticks\n");
1908 fprintf(fp,
"---------------------------- ---------- ---------- -----------\n");
1910 ProfileReport(fp, pl);
1917 fprintf(fp,
"\nOverall: %"PRIu64
" bytes written, average %d bytes per write.\n",
1920 fprintf(fp,
" PCAP data structure overhead: %"PRIuMAX
" per write.\n",
1921 (uintmax_t)
sizeof(
struct pcap_pkthdr));
1926 fprintf(fp,
" Size written: %s\n", bytes_str);
1929 uint64_t ticks_per_mib = 0, ticks_per_gib = 0;
1932 ticks_per_mib = total/mib;
1933 char ticks_per_mib_str[32] =
"n/a";
1934 if (ticks_per_mib > 0)
1935 FormatNumber(ticks_per_mib, ticks_per_mib_str,
sizeof(ticks_per_mib_str));
1936 fprintf(fp,
" Ticks per MiB: %s\n", ticks_per_mib_str);
1940 ticks_per_gib = total/gib;
1941 char ticks_per_gib_str[32] =
"n/a";
1942 if (ticks_per_gib > 0)
1943 FormatNumber(ticks_per_gib, ticks_per_gib_str,
sizeof(ticks_per_gib_str));
1944 fprintf(fp,
" Ticks per GiB: %s\n", ticks_per_gib_str);
1954 profiling_pcaplog_enabled = 1;
1955 SCLogInfo(
"pcap-log profiling enabled");
1958 if (filename != NULL) {
1959 const char *log_dir;
1962 profiling_pcaplog_file_name =
SCMalloc(PATH_MAX);
1963 if (
unlikely(profiling_pcaplog_file_name == NULL)) {
1967 snprintf(profiling_pcaplog_file_name, PATH_MAX,
"%s/%s", log_dir, filename);
1971 profiling_pcaplog_file_mode =
"a";
1973 profiling_pcaplog_file_mode =
"w";
1976 profiling_pcaplog_output_to_file = 1;
1977 SCLogInfo(
"pcap-log profiling output goes to %s (mode %s)",
1978 profiling_pcaplog_file_name, profiling_pcaplog_file_mode);