Go to the documentation of this file.
83 const uint64_t tx_id,
const bool stored, uint8_t dir,
HttpXFFCfg *xff_cfg,
120 JsonBuilder *js =
CreateEveHeader(p, fdir,
"fileinfo", &addr, eve_ctx);
124 JsonBuilderMark mark = { 0, 0, 0 };
128 jb_open_object(js,
"http");
133 jb_get_mark(js, &mark);
134 jb_open_object(js,
"smtp");
138 jb_restore_mark(js, &mark);
140 jb_get_mark(js, &mark);
141 jb_open_object(js,
"email");
145 jb_restore_mark(js, &mark);
150 jb_get_mark(js, &mark);
151 jb_open_object(js,
"rpc");
155 jb_restore_mark(js, &mark);
158 jb_get_mark(js, &mark);
159 jb_open_object(js,
"nfs");
163 jb_restore_mark(js, &mark);
167 jb_get_mark(js, &mark);
168 jb_open_object(js,
"smb");
172 jb_restore_mark(js, &mark);
177 if (al && al->
LogTx) {
178 void *state = FlowGetAppState(p->
flow);
182 jb_get_mark(js, &mark);
183 if (!al->
LogTx(tx, js)) {
184 jb_restore_mark(js, &mark);
194 jb_open_object(js,
"fileinfo");
206 jb_set_string(js,
"xff", xff_buffer);
231 void *tx,
const uint64_t tx_id, uint8_t dir)
245 static TmEcode JsonFileLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
253 SCLogDebug(
"Error getting context for EveLogFile. \"initdata\" argument NULL");
288 static void OutputFileLogDeinitSub(
OutputCtx *output_ctx)
308 if (
unlikely(output_file_ctx == NULL))
319 if (force_filestore != NULL &&
ConfValIsTrue(force_filestore)) {
327 SCLogConfig(
"forcing magic lookup for logged files");
335 if (output_file_ctx->
xff_cfg != NULL) {
342 output_file_ctx->
eve_ctx = ojc;
343 output_ctx->
data = output_file_ctx;
344 output_ctx->
DeInit = OutputFileLogDeinitSub;
347 result.
ctx = output_ctx;
356 OutputFileLogInitSub, JsonFileLogger, JsonFileLogThreadInit, JsonFileLogThreadDeinit);
bool EveSMTPAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
void FileForceTrackingEnable(void)
OutputJsonThreadCtx * ctx
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
EveJsonSimpleAppLayerLogger * SCEveJsonSimpleGetLogger(AppProto alproto)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
void JsonFileLogRegister(void)
bool EveNFSAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
const JsonAddrInfo json_addr_info_zero
void EveFileInfo(JsonBuilder *jb, const File *ff, const uint64_t tx_id, const uint16_t flags)
void FileForceMagicEnable(void)
void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file output sub-module.
bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
int ConfValIsTrue(const char *val)
Check if a value is true.
size_t strlcpy(char *dst, const char *src, size_t siz)
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
JsonBuilder * JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx, const uint64_t tx_id, const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCtx *eve_ctx)
bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
#define FLOW_PKT_TOCLIENT
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
bool EveEmailAddMetadata(const Flow *f, uint32_t tx_id, JsonBuilder *js)
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void FileForceFilestoreEnable(void)
void(* DeInit)(struct OutputCtx_ *)
EveJsonSimpleTxLogFunc LogTx
void FileForceHashParseCfg(ConfNode *conf)
Function to parse forced file hashing configuration.
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
char src_ip[JSON_ADDR_LEN]
char dst_ip[JSON_ADDR_LEN]
struct JsonFileLogThread_ JsonFileLogThread
void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir, JsonAddrInfo *addr)
void HttpXFFGetCfg(ConfNode *conf, HttpXFFCfg *result)
Function to return XFF configuration from a configuration node.
int HttpXFFGetIPFromTx(const Flow *f, uint64_t tx_id, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen)
Function to return XFF IP if any in the selected transaction. The caller needs to lock the flow.
bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
AppProto alproto
application level protocol
struct OutputFileCtx_ OutputFileCtx
OutputFileCtx * filelog_ctx
#define DEBUG_VALIDATE_BUG_ON(exp)
HttpXFFCfg * parent_xff_cfg
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.