suricata
output-eve-syslog.c
Go to the documentation of this file.
1 /* vi: set et ts=4: */
2 /* Copyright (C) 2021 Open Information Security Foundation
3  *
4  * You can copy, redistribute or modify this Program under the terms of
5  * the GNU General Public License version 2 as published by the Free
6  * Software Foundation.
7  *
8  * This program is distributed in the hope that it will be useful,
9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11  * GNU General Public License for more details.
12  *
13  * You should have received a copy of the GNU General Public License
14  * version 2 along with this program; if not, write to the Free Software
15  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
16  * 02110-1301, USA.
17  */
18 
19 /**
20  * \file
21  *
22  * \author Mike Pomraning <mpomraning@qualys.com>
23  * \author Jeff Lucovsky <jeff@lucovsky.org>
24  *
25  * File-like output for logging: syslog
26  */
27 
28 #include "suricata-common.h" /* errno.h, string.h, etc. */
29 #include "output.h" /* DEFAULT_LOG_* */
30 #include "output-eve-syslog.h"
31 #include "util-syslog.h"
32 
33 #ifdef OS_WIN32
34 void SyslogInitialize(void)
35 {
36 }
37 #else /* !OS_WIN32 */
38 #define OUTPUT_NAME "syslog"
39 
40 typedef struct Context_ {
43 
44 static int SyslogInit(ConfNode *conf, bool threaded, void **init_data)
45 {
46  Context *context = SCCalloc(1, sizeof(Context));
47  if (context == NULL) {
48  SCLogError(SC_ERR_MEM_ALLOC, "Unable to allocate context for %s", OUTPUT_NAME);
49  return -1;
50  }
51  const char *facility_s = ConfNodeLookupChildValue(conf, "facility");
52  if (facility_s == NULL) {
54  }
55 
56  int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap());
57  if (facility == -1) {
59  "Invalid syslog facility: \"%s\","
60  " now using \"%s\" as syslog facility",
63  }
64 
65  const char *level_s = ConfNodeLookupChildValue(conf, "level");
66  if (level_s != NULL) {
67  int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap());
68  if (level != -1) {
69  context->alert_syslog_level = level;
70  }
71  }
72 
73  const char *ident = ConfNodeLookupChildValue(conf, "identity");
74  /* if null we just pass that to openlog, which will then
75  * figure it out by itself. */
76 
77  openlog(ident, LOG_PID | LOG_NDELAY, facility);
78  SCLogNotice("Syslog: facility %s, level %s, ident %s", facility_s, level_s, ident);
79  *init_data = context;
80  return 0;
81 }
82 
83 static int SyslogWrite(const char *buffer, int buffer_len, void *init_data, void *thread_data)
84 {
85  Context *context = init_data;
86  syslog(context->alert_syslog_level, "%s", (const char *)buffer);
87 
88  return 0;
89 }
90 
91 static void SyslogDeInit(void *init_data)
92 {
93  if (init_data) {
94  closelog();
95  SCFree(init_data);
96  }
97 }
98 
99 void SyslogInitialize(void)
100 {
101  SCEveFileType *file_type = SCCalloc(1, sizeof(SCEveFileType));
102 
103  if (file_type == NULL) {
104  FatalError(SC_ERR_MEM_ALLOC, "Unable to allocate memory for eve file type %s", OUTPUT_NAME);
105  }
106 
107  file_type->name = OUTPUT_NAME;
108  file_type->Init = SyslogInit;
109  file_type->Deinit = SyslogDeInit;
110  file_type->Write = SyslogWrite;
111  if (!SCRegisterEveFileType(file_type)) {
112  FatalError(SC_ERR_LOG_OUTPUT, "Failed to register EVE file type: %s", OUTPUT_NAME);
113  }
114 }
115 #endif /* !OS_WIN32 */
SCEveFileType_::Write
int(* Write)(const char *buffer, int buffer_len, void *init_data, void *thread_data)
Definition: suricata-plugin.h:54
syslog
#define syslog(__pri, __fmt, __param)
Definition: win32-syslog.h:78
SCEveFileType_::name
const char * name
Definition: suricata-plugin.h:50
Context_
Definition: output-eve-syslog.c:40
util-syslog.h
SCEveFileType_::Init
int(* Init)(ConfNode *conf, bool threaded, void **init_data)
Definition: suricata-plugin.h:52
closelog
#define closelog()
Definition: win32-syslog.h:75
DEFAULT_ALERT_SYSLOG_FACILITY
#define DEFAULT_ALERT_SYSLOG_FACILITY
Definition: util-syslog.h:35
SCSyslogGetFacilityMap
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:57
DEFAULT_ALERT_SYSLOG_FACILITY_STR
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR
Definition: util-syslog.h:34
SCRegisterEveFileType
bool SCRegisterEveFileType(SCEveFileType *)
SyslogInitialize
void SyslogInitialize(void)
Definition: output-eve-syslog.c:99
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
SCSyslogGetLogLevelMap
SCEnumCharMap * SCSyslogGetLogLevelMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:75
SCMapEnumNameToValue
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:40
suricata-common.h
OUTPUT_NAME
#define OUTPUT_NAME
Definition: output-eve-syslog.c:38
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:255
output-eve-syslog.h
FatalError
#define FatalError(x,...)
Definition: util-debug.h:530
SCEveFileType_::Deinit
void(* Deinit)(void *init_data)
Definition: suricata-plugin.h:56
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
SC_ERR_MEM_ALLOC
@ SC_ERR_MEM_ALLOC
Definition: util-error.h:31
SC_ERR_LOG_OUTPUT
@ SC_ERR_LOG_OUTPUT
Definition: util-error.h:368
Context
struct Context_ Context
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:230
openlog
#define openlog(__ident, __option, __facility)
Definition: win32-syslog.h:76
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
Context_::alert_syslog_level
int alert_syslog_level
Definition: output-eve-syslog.c:41
output.h
SCEveFileType_
Definition: suricata-plugin.h:47
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:798