suricata
output-json.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"
#include "threads.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-reference.h"
#include "app-layer-parser.h"
#include "util-classification-config.h"
#include "util-syslog.h"
#include "output.h"
#include "output-json.h"
#include "util-byte.h"
#include "util-privs.h"
#include "util-print.h"
#include "util-proto-name.h"
#include "util-optimize.h"
#include "util-buffer.h"
#include "util-logopenfile.h"
#include "util-log-redis.h"
#include "util-device.h"
#include "util-validate.h"
#include "util-crypt.h"
#include "flow-var.h"
#include "flow-bit.h"
#include "source-pcap-file.h"
Include dependency graph for output-json.c:

Go to the source code of this file.

Macros

#define DEFAULT_LOG_FILENAME   "eve.json"
 
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR   "local0"
 
#define DEFAULT_ALERT_SYSLOG_FACILITY   LOG_LOCAL0
 
#define DEFAULT_ALERT_SYSLOG_LEVEL   LOG_INFO
 
#define MODULE_NAME   "OutputJSON"
 
#define MAX_JSON_SIZE   2048
 

Functions

void OutputJsonRegister (void)
 
json_t * SCJsonBool (int val)
 
void SCJsonDecref (json_t *json)
 
json_t * SCJsonString (const char *val)
 
json_t * JsonAddStringN (const char *string, size_t size)
 Create a JSON string from a character sequence. More...
 
void JsonAddCommonOptions (const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, json_t *js)
 
void JsonPacket (const Packet *p, json_t *js, unsigned long max_length)
 Jsonify a packet. More...
 
void JsonTcpFlags (uint8_t flags, json_t *js)
 jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact. More...
 
void JsonFiveTuple (const Packet *p, enum OutputJsonLogDirection dir, json_t *js)
 Add five tuple from packet to JSON object. More...
 
void CreateJSONFlowId (json_t *js, const Flow *f)
 
json_t * CreateJSONHeader (const Packet *p, enum OutputJsonLogDirection dir, const char *event_type)
 
json_t * CreateJSONHeaderWithTxId (const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, uint64_t tx_id)
 
int OutputJSONMemBufferCallback (const char *str, size_t size, void *data)
 
int OutputJSONBuffer (json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
 
OutputInitResult OutputJsonInitCtx (ConfNode *conf)
 Create a new LogFileCtx for "fast" output style. More...
 

Detailed Description

Author
Tom DeCanio td@np.nosp@m.ulse.nosp@m.tech..nosp@m.com

Logs detection and monitoring events in JSON format.

Definition in file output-json.c.

Macro Definition Documentation

#define DEFAULT_ALERT_SYSLOG_FACILITY   LOG_LOCAL0

Definition at line 71 of file output-json.c.

Referenced by OutputJsonInitCtx().

#define DEFAULT_ALERT_SYSLOG_FACILITY_STR   "local0"

Definition at line 70 of file output-json.c.

Referenced by OutputJsonInitCtx().

#define DEFAULT_ALERT_SYSLOG_LEVEL   LOG_INFO

Definition at line 72 of file output-json.c.

#define DEFAULT_LOG_FILENAME   "eve.json"

Definition at line 69 of file output-json.c.

Referenced by OutputJsonInitCtx().

#define MAX_JSON_SIZE   2048

Definition at line 75 of file output-json.c.

Referenced by SCJsonString().

#define MODULE_NAME   "OutputJSON"

Definition at line 73 of file output-json.c.

Referenced by OutputJsonRegister().

Function Documentation

void CreateJSONFlowId ( json_t *  js,
const Flow f 
)

Definition at line 699 of file output-json.c.

References Flow_::parent_id.

Referenced by CreateJSONHeader().

Here is the caller graph for this function:

json_t* CreateJSONHeaderWithTxId ( const Packet p,
enum OutputJsonLogDirection  dir,
const char *  event_type,
uint64_t  tx_id 
)

Definition at line 783 of file output-json.c.

References CreateJSONHeader(), and unlikely.

Referenced by JsonHttpLogJSONBodyBase64().

Here is the call graph for this function:

Here is the caller graph for this function:

json_t* JsonAddStringN ( const char *  string,
size_t  size 
)
void JsonFiveTuple ( const Packet p,
enum OutputJsonLogDirection  dir,
json_t *  js 
)
void JsonPacket ( const Packet p,
json_t *  js,
unsigned long  max_length 
)

Jsonify a packet.

Parameters
pPacket
jsJSON object
max_lengthIf non-zero, restricts the number of packet data bytes handled.

Definition at line 408 of file output-json.c.

References Base64Encode(), Packet_::datalink, GET_PKT_DATA, GET_PKT_LEN, len, SC_BASE64_OK, and unlikely.

Referenced by AlertJsonHeader().

Here is the call graph for this function:

Here is the caller graph for this function:

void JsonTcpFlags ( uint8_t  flags,
json_t *  js 
)

jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.

Definition at line 428 of file output-json.c.

References TH_ACK, TH_CWR, TH_ECN, TH_FIN, TH_PUSH, TH_RST, TH_SYN, and TH_URG.

Referenced by JsonAddFlow().

Here is the caller graph for this function:

OutputInitResult OutputJsonInitCtx ( ConfNode conf)

Create a new LogFileCtx for "fast" output style.

Parameters
confThe configuration node for this output.
Returns
A LogFileCtx pointer on success, NULL on failure.

Definition at line 843 of file output-json.c.

References SyslogSetup_::alert_syslog_level, ByteExtractStringUint16(), ByteExtractStringUint64(), OutputJsonCtx_::cfg, OutputJsonCommonSettings_::community_id_seed, ConfGet(), ConfNodeLookupChild(), ConfNodeLookupChildValue(), ConfValIsFalse(), ConfValIsTrue(), OutputInitResult_::ctx, OutputCtx_::data, DEFAULT_ALERT_SYSLOG_FACILITY, DEFAULT_ALERT_SYSLOG_FACILITY_STR, DEFAULT_LOG_FILENAME, OutputCtx_::DeInit, OutputJsonCtx_::file_ctx, HttpXFFGetCfg(), OutputJsonCommonSettings_::include_community_id, OutputJsonCommonSettings_::include_metadata, LogFileCtx_::is_pcap_offline, OutputJsonCtx_::json_out, likely, LOGFILE_TYPE_FILE, LOGFILE_TYPE_REDIS, LOGFILE_TYPE_SYSLOG, LOGFILE_TYPE_UNIX_DGRAM, LOGFILE_TYPE_UNIX_STREAM, LogFileFreeCtx(), LogFileNewCtx(), OutputInitResult_::ok, openlog, OutputRegisterFileRotationFlag(), LogFileCtx_::prefix, LogFileCtx_::prefix_len, LogFileCtx_::rotation_flag, RUNMODE_PCAP_FILE, RunmodeGetCurrent(), SC_ERR_DEPRECATED_CONF, SC_ERR_INVALID_ARGUMENT, SC_ERR_MEM_ALLOC, SC_WARN_EVENT_DROPPED, SCCalloc, SCConfLogOpenGeneric(), SCFree, SCLogDebug, SCLogError, SCLogInfo, SCLogWarning, SCMapEnumNameToValue(), SCStrdup, SCSyslogGetFacilityMap(), SCSyslogGetLogLevelMap(), LogFileCtx_::sensor_name, LogFileCtx_::syslog_setup, LogFileCtx_::type, unlikely, ConfNode_::val, and OutputJsonCtx_::xff_cfg.

Referenced by OutputJsonRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

int OutputJSONMemBufferCallback ( const char *  str,
size_t  size,
void *  data 
)

Definition at line 796 of file output-json.c.

References OutputJSONMemBufferWrapper_::buffer, OutputJSONMemBufferWrapper_::expand_by, MEMBUFFER_OFFSET, MEMBUFFER_SIZE, MemBufferExpand(), and MemBufferWriteRaw.

Referenced by EngineAnalysisRules2(), OutputJSONBuffer(), and RulesDumpMatchArray().

Here is the call graph for this function:

Here is the caller graph for this function:

void OutputJsonRegister ( void  )

Definition at line 85 of file output-json.c.

References MODULE_NAME, OutputJsonInitCtx(), and OutputRegisterModule().

Referenced by OutputRegisterLoggers().

Here is the call graph for this function:

Here is the caller graph for this function:

json_t* SCJsonBool ( int  val)

Definition at line 93 of file output-json.c.

void SCJsonDecref ( json_t *  json)

Wrap json_decref. This is mainly to expose this function to Rust as its defined in the Jansson header file as an inline function.

Definition at line 102 of file output-json.c.

json_t* SCJsonString ( const char *  val)