suricata
output-json.c File Reference
#include "suricata-common.h"
#include "debug.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"
#include "threads.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-reference.h"
#include "app-layer-parser.h"
#include "util-classification-config.h"
#include "util-syslog.h"
#include "output.h"
#include "output-json.h"
#include "util-byte.h"
#include "util-privs.h"
#include "util-print.h"
#include "util-proto-name.h"
#include "util-optimize.h"
#include "util-buffer.h"
#include "util-logopenfile.h"
#include "util-log-redis.h"
#include "util-device.h"
#include "util-validate.h"
#include "util-crypt.h"
#include "flow-var.h"
#include "flow-bit.h"
#include "source-pcap-file.h"
Include dependency graph for output-json.c:

Go to the source code of this file.

Macros

#define DEFAULT_LOG_FILENAME   "eve.json"
 
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR   "local0"
 
#define DEFAULT_ALERT_SYSLOG_FACILITY   LOG_LOCAL0
 
#define DEFAULT_ALERT_SYSLOG_LEVEL   LOG_INFO
 
#define MODULE_NAME   "OutputJSON"
 
#define MAX_JSON_SIZE   2048
 

Functions

void OutputJsonRegister (void)
 
json_t * SCJsonBool (int val)
 
void SCJsonDecref (json_t *json)
 
json_t * SCJsonString (const char *val)
 
json_t * JsonAddStringN (const char *string, size_t size)
 Create a JSON string from a character sequence. More...
 
void JsonAddCommonOptions (const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, json_t *js)
 
void JsonPacket (const Packet *p, json_t *js, unsigned long max_length)
 Jsonify a packet. More...
 
void JsonTcpFlags (uint8_t flags, json_t *js)
 jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact. More...
 
void JsonFiveTuple (const Packet *p, enum OutputJsonLogDirection dir, json_t *js)
 Add five tuple from packet to JSON object. More...
 
void CreateJSONFlowId (json_t *js, const Flow *f)
 
json_t * CreateJSONHeader (const Packet *p, enum OutputJsonLogDirection dir, const char *event_type)
 
json_t * CreateJSONHeaderWithTxId (const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, uint64_t tx_id)
 
int OutputJSONMemBufferCallback (const char *str, size_t size, void *data)
 
int OutputJSONBuffer (json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
 
OutputInitResult OutputJsonInitCtx (ConfNode *conf)
 Create a new LogFileCtx for "fast" output style. More...
 

Detailed Description

Author
Tom DeCanio td@np.nosp@m.ulse.nosp@m.tech..nosp@m.com

Logs detection and monitoring events in JSON format.

Definition in file output-json.c.

Macro Definition Documentation

◆ DEFAULT_ALERT_SYSLOG_FACILITY

#define DEFAULT_ALERT_SYSLOG_FACILITY   LOG_LOCAL0

Definition at line 71 of file output-json.c.

◆ DEFAULT_ALERT_SYSLOG_FACILITY_STR

#define DEFAULT_ALERT_SYSLOG_FACILITY_STR   "local0"

Definition at line 70 of file output-json.c.

◆ DEFAULT_ALERT_SYSLOG_LEVEL

#define DEFAULT_ALERT_SYSLOG_LEVEL   LOG_INFO

Definition at line 72 of file output-json.c.

◆ DEFAULT_LOG_FILENAME

#define DEFAULT_LOG_FILENAME   "eve.json"

Definition at line 69 of file output-json.c.

◆ MAX_JSON_SIZE

#define MAX_JSON_SIZE   2048

Definition at line 75 of file output-json.c.

◆ MODULE_NAME

#define MODULE_NAME   "OutputJSON"

Definition at line 73 of file output-json.c.

Function Documentation

◆ CreateJSONFlowId()

void CreateJSONFlowId ( json_t *  js,
const Flow f 
)

Definition at line 699 of file output-json.c.

Referenced by CreateJSONHeader().

Here is the caller graph for this function:

◆ CreateJSONHeader()

json_t* CreateJSONHeader ( const Packet p,
enum OutputJsonLogDirection  dir,
const char *  event_type 
)

Definition at line 710 of file output-json.c.

References CreateIsoTimeString(), CreateJSONFlowId(), Packet_::flow, Packet_::ts, and unlikely.

Referenced by CreateJSONHeaderWithTxId(), JsonBuildFileInfoRecord(), and RulesDumpMatchArray().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ CreateJSONHeaderWithTxId()

json_t* CreateJSONHeaderWithTxId ( const Packet p,
enum OutputJsonLogDirection  dir,
const char *  event_type,
uint64_t  tx_id 
)

Definition at line 783 of file output-json.c.

References CreateJSONHeader(), and unlikely.

Here is the call graph for this function:

◆ JsonAddCommonOptions()

void JsonAddCommonOptions ( const OutputJsonCommonSettings cfg,
const Packet p,
const Flow f,
json_t *  js 
)

Definition at line 390 of file output-json.c.

References OutputJsonCommonSettings_::include_metadata.

◆ JsonAddStringN()

json_t* JsonAddStringN ( const char *  string,
size_t  size 
)

Create a JSON string from a character sequence.

Parameters
Pointerto character sequence
Numberof characters to use from the sequence
Return values
JSONobject for the character sequence

Definition at line 142 of file output-json.c.

References SCJsonString().

Here is the call graph for this function:

◆ JsonFiveTuple()

void JsonFiveTuple ( const Packet p,
enum OutputJsonLogDirection  dir,
json_t *  js 
)

Add five tuple from packet to JSON object.

Parameters
pPacket
dirlog direction (packet or flow)
jsJSON object

Definition at line 455 of file output-json.c.

References DEBUG_VALIDATE_BUG_ON, Packet_::dp, GET_IPV4_DST_ADDR_PTR, GET_IPV4_SRC_ADDR_PTR, GET_IPV6_DST_ADDR, GET_IPV6_SRC_ADDR, IP_GET_IPPROTO, known_proto, LOG_DIR_FLOW, LOG_DIR_FLOW_TOCLIENT, LOG_DIR_FLOW_TOSERVER, LOG_DIR_PACKET, PKT_IS_IPV4, PKT_IS_IPV6, PKT_IS_TOCLIENT, PKT_IS_TOSERVER, PrintInet(), proto, Packet_::proto, SCProtoNameValid(), Packet_::sp, strlcpy(), and TRUE.

Here is the call graph for this function:

◆ JsonPacket()

void JsonPacket ( const Packet p,
json_t *  js,
unsigned long  max_length 
)

Jsonify a packet.

Parameters
pPacket
jsJSON object
max_lengthIf non-zero, restricts the number of packet data bytes handled.

Definition at line 408 of file output-json.c.

References Base64Encode(), Packet_::datalink, GET_PKT_DATA, GET_PKT_LEN, len, SC_BASE64_OK, and unlikely.

Here is the call graph for this function:

◆ JsonTcpFlags()

void JsonTcpFlags ( uint8_t  flags,
json_t *  js 
)

jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.

Definition at line 428 of file output-json.c.

References flags, TH_ACK, TH_CWR, TH_ECN, TH_FIN, TH_PUSH, TH_RST, TH_SYN, and TH_URG.

◆ OutputJSONBuffer()

◆ OutputJsonInitCtx()

OutputInitResult OutputJsonInitCtx ( ConfNode conf)

Create a new LogFileCtx for "fast" output style.

Parameters
confThe configuration node for this output.
Returns
A LogFileCtx pointer on success, NULL on failure.

Definition at line 843 of file output-json.c.

References ConfGet(), ConfNodeLookupChildValue(), OutputCtx_::data, OutputCtx_::DeInit, OutputJsonCtx_::file_ctx, LogFileFreeCtx(), LogFileNewCtx(), SC_ERR_DEPRECATED_CONF, SCCalloc, SCFree, SCLogDebug, SCLogWarning, SCStrdup, LogFileCtx_::sensor_name, and unlikely.

Referenced by OutputJsonRegister().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ OutputJSONMemBufferCallback()

int OutputJSONMemBufferCallback ( const char *  str,
size_t  size,
void *  data 
)

Definition at line 796 of file output-json.c.

References OutputJSONMemBufferWrapper_::buffer, OutputJSONMemBufferWrapper_::expand_by, MEMBUFFER_OFFSET, MEMBUFFER_SIZE, MemBufferExpand(), MemBufferWriteRaw, and str.

Referenced by OutputJSONBuffer().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ OutputJsonRegister()

void OutputJsonRegister ( void  )

Definition at line 85 of file output-json.c.

References MODULE_NAME, OutputJsonInitCtx(), and OutputRegisterModule().

Referenced by OutputRegisterLoggers().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SCJsonBool()

json_t* SCJsonBool ( int  val)

Definition at line 93 of file output-json.c.

◆ SCJsonDecref()

void SCJsonDecref ( json_t *  json)

Wrap json_decref. This is mainly to expose this function to Rust as its defined in the Jansson header file as an inline function.

Definition at line 102 of file output-json.c.

◆ SCJsonString()

json_t* SCJsonString ( const char *  val)

Definition at line 107 of file output-json.c.

References MAX_JSON_SIZE, offset, and PrintBufferData.

Referenced by AlertJsonHeader(), JsonAddStringN(), JsonBuildFileInfoRecord(), JsonFTPDataAddMetadata(), JsonSshLogJSON(), and OutputJsonDNP3SetItem().

Here is the caller graph for this function: