Go to the documentation of this file.
66 #define DEFAULT_LOG_FILENAME "eve.json"
67 #define MODULE_NAME "OutputJSON"
69 #define MAX_JSON_SIZE 2048
71 static void OutputJsonDeInitCtx(
OutputCtx *);
72 static void CreateEveCommunityFlowId(SCJsonBuilder *js,
const Flow *f,
const uint16_t seed);
73 static int CreateJSONEther(
76 static const char *TRAFFIC_ID_PREFIX =
"traffic/id/";
77 static const char *TRAFFIC_LABEL_PREFIX =
"traffic/label/";
78 static size_t traffic_id_prefix_len = 0;
79 static size_t traffic_label_prefix_len = 0;
87 traffic_id_prefix_len = strlen(TRAFFIC_ID_PREFIX);
88 traffic_label_prefix_len = strlen(TRAFFIC_LABEL_PREFIX);
101 json_t * retval = json_string(val);
103 if (retval == NULL) {
106 for (u = 0; u < strlen(val); u++) {
107 if (isprint(val[u])) {
116 retval = json_string(retbuf);
122 static int64_t sensor_id = -1;
126 SCJbSetStringFromBytes(jb,
"filename", ff->
name, ff->
name_len);
129 SCJbOpenArray(jb,
"sid");
130 for (uint32_t i = 0; ff->
sid != NULL && i < ff->
sid_cnt; i++) {
131 SCJbAppendUint(jb, ff->
sid[i]);
138 SCJbSetString(jb,
"magic", (
char *)ff->magic);
145 SCJbSetHex(jb,
"md5", (uint8_t *)ff->
md5, (uint32_t)
sizeof(ff->
md5));
148 SCJbSetHex(jb,
"sha1", (uint8_t *)ff->
sha1, (uint32_t)
sizeof(ff->
sha1));
163 SCJbSetHex(jb,
"sha256", (uint8_t *)ff->
sha256, (uint32_t)
sizeof(ff->
sha256));
178 SCJbSetUint(jb,
"start", ff->
start);
179 SCJbSetUint(jb,
"end", ff->
end);
181 SCJbSetUint(jb,
"tx_id", tx_id);
184 static void EveAddPacketVars(
const Packet *p, SCJsonBuilder *js_vars)
186 if (p == NULL || p->
pktvar == NULL) {
192 if (pv->
key || pv->
id > 0) {
194 SCJbOpenArray(js_vars,
"pktvars");
197 SCJbStartObject(js_vars);
199 if (pv->
key != NULL) {
201 uint8_t keybuf[pv->
key_len + 1];
204 uint8_t printable_buf[
len + 1];
207 SCJbSetString(js_vars, (
char *)keybuf, (
char *)printable_buf);
211 uint8_t printable_buf[
len + 1];
214 SCJbSetString(js_vars, varname, (
char *)printable_buf);
233 static bool SCStringHasPrefix(
const char *s,
const char *prefix)
235 if (strncmp(s, prefix, strlen(prefix)) == 0) {
241 static void EveAddFlowVars(
const Flow *f, SCJsonBuilder *js_root, SCJsonBuilder **js_traffic)
243 if (f == NULL || f->
flowvar == NULL) {
246 SCJsonBuilder *js_flowvars = NULL;
247 SCJsonBuilder *js_traffic_id = NULL;
248 SCJsonBuilder *js_traffic_label = NULL;
249 SCJsonBuilder *js_flowints = NULL;
250 SCJsonBuilder *js_entropyvals = NULL;
251 SCJsonBuilder *js_flowbits = NULL;
260 if (js_flowvars == NULL) {
261 js_flowvars = SCJbNewArray();
262 if (js_flowvars == NULL)
267 uint8_t printable_buf[
len + 1];
272 SCJbStartObject(js_flowvars);
273 SCJbSetString(js_flowvars, varname, (
char *)printable_buf);
274 SCJbClose(js_flowvars);
277 if (js_flowvars == NULL) {
278 js_flowvars = SCJbNewArray();
279 if (js_flowvars == NULL)
283 uint8_t keybuf[fv->
keylen + 1];
288 uint8_t printable_buf[
len + 1];
293 SCJbStartObject(js_flowvars);
294 SCJbSetString(js_flowvars, (
const char *)keybuf, (
char *)printable_buf);
295 SCJbClose(js_flowvars);
299 if (js_entropyvals == NULL) {
300 js_entropyvals = SCJbNewObject();
301 if (js_entropyvals == NULL)
311 if (js_flowints == NULL) {
312 js_flowints = SCJbNewObject();
313 if (js_flowints == NULL)
324 if (SCStringHasPrefix(varname, TRAFFIC_ID_PREFIX)) {
325 if (js_traffic_id == NULL) {
326 js_traffic_id = SCJbNewArray();
327 if (
unlikely(js_traffic_id == NULL)) {
331 SCJbAppendString(js_traffic_id, &varname[traffic_id_prefix_len]);
332 }
else if (SCStringHasPrefix(varname, TRAFFIC_LABEL_PREFIX)) {
333 if (js_traffic_label == NULL) {
334 js_traffic_label = SCJbNewArray();
335 if (
unlikely(js_traffic_label == NULL)) {
339 SCJbAppendString(js_traffic_label, &varname[traffic_label_prefix_len]);
341 if (js_flowbits == NULL) {
342 js_flowbits = SCJbNewArray();
346 SCJbAppendString(js_flowbits, varname);
353 SCJbClose(js_flowbits);
354 SCJbSetObject(js_root,
"flowbits", js_flowbits);
355 SCJbFree(js_flowbits);
358 SCJbClose(js_flowints);
359 SCJbSetObject(js_root,
"flowints", js_flowints);
360 SCJbFree(js_flowints);
362 if (js_entropyvals) {
363 SCJbClose(js_entropyvals);
364 SCJbSetObject(js_root,
"entropy", js_entropyvals);
365 SCJbFree(js_entropyvals);
368 SCJbClose(js_flowvars);
369 SCJbSetObject(js_root,
"flowvars", js_flowvars);
370 SCJbFree(js_flowvars);
373 if (js_traffic_id != NULL || js_traffic_label != NULL) {
374 *js_traffic = SCJbNewObject();
375 if (
likely(*js_traffic != NULL)) {
376 if (js_traffic_id != NULL) {
377 SCJbClose(js_traffic_id);
378 SCJbSetObject(*js_traffic,
"id", js_traffic_id);
379 SCJbFree(js_traffic_id);
381 if (js_traffic_label != NULL) {
382 SCJbClose(js_traffic_label);
383 SCJbSetObject(*js_traffic,
"label", js_traffic_label);
384 SCJbFree(js_traffic_label);
386 SCJbClose(*js_traffic);
394 SCJsonBuilder *js_vars = SCJbNewObject();
397 SCJsonBuilder *js_traffic = NULL;
398 EveAddFlowVars(f, js_vars, &js_traffic);
399 if (js_traffic != NULL) {
400 SCJbSetObject(js,
"traffic", js_traffic);
401 SCJbFree(js_traffic);
405 EveAddPacketVars(p, js_vars);
408 SCJbSetObject(js,
"metadata", js_vars);
418 SCJbSetString(js,
"suricata_version",
PROG_VER);
424 CreateJSONEther(js, p, f, dir);
430 SCJbSetUint(js,
"tenant_id", f->
tenant_id);
443 uint32_t max_len = max_length == 0 ?
GET_PKT_LEN(p) : max_length;
446 if (!SCJbOpenObject(js,
"packet_info")) {
449 if (!SCJbSetUint(js,
"linktype", p->
datalink)) {
458 (void)SCJbSetString(js,
"linktype_name", dl_name == NULL ?
"n/a" : dl_name);
488 char srcip[46] = {0}, dstip[46] = {0};
493 if (PacketIsIPv4(p)) {
495 srcip,
sizeof(srcip));
497 dstip,
sizeof(dstip));
498 }
else if (PacketIsIPv6(p)) {
500 srcip,
sizeof(srcip));
502 dstip,
sizeof(dstip));
513 if (PacketIsIPv4(p)) {
515 srcip,
sizeof(srcip));
517 dstip,
sizeof(dstip));
518 }
else if (PacketIsIPv6(p)) {
520 srcip,
sizeof(srcip));
522 dstip,
sizeof(dstip));
527 if (PacketIsIPv4(p)) {
529 srcip,
sizeof(srcip));
531 dstip,
sizeof(dstip));
532 }
else if (PacketIsIPv6(p)) {
534 srcip,
sizeof(srcip));
536 dstip,
sizeof(dstip));
544 if (PacketIsIPv4(p)) {
546 srcip,
sizeof(srcip));
548 dstip,
sizeof(dstip));
549 }
else if (PacketIsIPv6(p)) {
551 srcip,
sizeof(srcip));
553 dstip,
sizeof(dstip));
558 if (PacketIsIPv4(p)) {
560 srcip,
sizeof(srcip));
562 dstip,
sizeof(dstip));
563 }
else if (PacketIsIPv6(p)) {
565 srcip,
sizeof(srcip));
567 dstip,
sizeof(dstip));
597 snprintf(addr->
proto,
sizeof(addr->
proto),
"%" PRIu32, PacketGetIPProto(p));
601 #define COMMUNITY_ID_BUF_SIZE 64
603 static bool CalculateCommunityFlowIdv4(
const Flow *f,
604 const uint16_t seed,
unsigned char *base64buf)
616 uint32_t
src = f->
src.addr_data32[0];
617 uint32_t
dst = f->
dst.addr_data32[0];
619 if (f->
proto == IPPROTO_ICMP)
623 if (f->
proto == IPPROTO_ICMP)
627 ipv4.seed = htons(seed);
628 if (ntohl(
src) < ntohl(
dst) || (
src ==
dst && sp < dp)) {
639 ipv4.proto = f->
proto;
643 if (SCSha1HashBuffer((
const uint8_t *)&ipv4,
sizeof(ipv4), hash,
sizeof(hash)) == 1) {
646 if (SCBase64Encode(hash,
sizeof(hash), base64buf + 2, &out_len) == SC_BASE64_OK) {
653 static bool CalculateCommunityFlowIdv6(
const Flow *f,
654 const uint16_t seed,
unsigned char *base64buf)
667 if (f->
proto == IPPROTO_ICMPV6)
671 if (f->
proto == IPPROTO_ICMPV6)
675 ipv6.seed = htons(seed);
676 int cmp_r = memcmp(&f->
src, &f->
dst,
sizeof(f->
src));
677 if ((cmp_r < 0) || (cmp_r == 0 && sp < dp)) {
678 memcpy(&ipv6.src, &f->
src.addr_data32, 16);
679 memcpy(&ipv6.dst, &f->
dst.addr_data32, 16);
683 memcpy(&ipv6.src, &f->
dst.addr_data32, 16);
684 memcpy(&ipv6.dst, &f->
src.addr_data32, 16);
688 ipv6.proto = f->
proto;
692 if (SCSha1HashBuffer((
const uint8_t *)&ipv6,
sizeof(ipv6), hash,
sizeof(hash)) == 1) {
695 if (SCBase64Encode(hash,
sizeof(hash), base64buf + 2, &out_len) == SC_BASE64_OK) {
702 static void CreateEveCommunityFlowId(SCJsonBuilder *js,
const Flow *f,
const uint16_t seed)
706 if (CalculateCommunityFlowIdv4(f, seed, buf)) {
707 SCJbSetString(js,
"community_id", (
const char *)buf);
710 if (CalculateCommunityFlowIdv6(f, seed, buf)) {
711 SCJbSetString(js,
"community_id", (
const char *)buf);
721 uint64_t flow_id = FlowGetId(f);
722 SCJbSetUint(js,
"flow_id", flow_id);
724 SCJbSetUint(js,
"parent_id", f->
parent_id);
731 (void) snprintf(eth_addr, 19,
"%02x:%02x:%02x:%02x:%02x:%02x",
732 val[0], val[1], val[2], val[3], val[4], val[5]);
734 SCJbAppendString(js, eth_addr);
736 SCJbSetString(js, key, eth_addr);
745 static int MacSetIterateToJSON(uint8_t *val,
MacSetSide side,
void *data)
756 static int CreateJSONEther(
761 if (PacketIsEthernet(p)) {
762 const EthernetHdr *ethh = PacketGetEthernet(p);
763 SCJbOpenObject(js,
"ether");
764 SCJbSetUint(js,
"ether_type", ethh->eth_type);
797 }
else if (f != NULL) {
806 if (
dst != NULL &&
src != NULL) {
807 SCJbOpenObject(js,
"ether");
814 }
else if (f != NULL) {
819 SCJbOpenObject(js,
"ether");
821 info.
dst = SCJbNewArray();
822 info.
src = SCJbNewArray();
835 SCJbSetObject(js,
"dest_macs", info.
src);
836 SCJbSetObject(js,
"src_macs", info.
dst);
839 SCJbSetObject(js,
"dest_macs", info.
dst);
840 SCJbSetObject(js,
"src_macs", info.
src);
856 SCJsonBuilder *js = SCJbNewObject();
863 SCJbSetString(js,
"timestamp", timebuf);
868 if (sensor_id >= 0) {
869 SCJbSetUint(js,
"sensor_id", sensor_id);
874 SCJbSetString(js,
"in_iface", p->
livedev->
dev);
879 SCJbSetUint(js,
"pcap_cnt", p->
pcap_cnt);
883 SCJbSetString(js,
"event_type", event_type);
888 SCJbOpenArray(js,
"vlan");
889 SCJbAppendUint(js, p->
vlan_id[0]);
891 SCJbAppendUint(js, p->
vlan_id[1]);
894 SCJbAppendUint(js, p->
vlan_id[2]);
905 if (addr->
src_ip[0] !=
'\0') {
906 SCJbSetString(js,
"src_ip", addr->
src_ip);
909 SCJbSetUint(js,
"src_port", addr->
sp);
911 if (addr->
dst_ip[0] !=
'\0') {
912 SCJbSetString(js,
"dest_ip", addr->
dst_ip);
915 SCJbSetUint(js,
"dest_port", addr->
dp);
917 if (addr->
proto[0] !=
'\0') {
918 SCJbSetString(js,
"proto", addr->
proto);
922 if (PacketIsIPv4(p)) {
923 SCJbSetUint(js,
"ip_v", 4);
924 }
else if (PacketIsIPv6(p)) {
925 SCJbSetUint(js,
"ip_v", 6);
931 if (PacketIsICMPv4(p)) {
932 SCJbSetUint(js,
"icmp_type", p->
icmp_s.type);
933 SCJbSetUint(js,
"icmp_code", p->
icmp_s.code);
937 if (PacketIsICMPv6(p)) {
938 SCJbSetUint(js,
"icmp_type", PacketGetICMPv6(p)->
type);
939 SCJbSetUint(js,
"icmp_code", PacketGetICMPv6(p)->code);
946 if (eve_ctx != NULL) {
956 SCJsonBuilder *js =
CreateEveHeader(p, dir, event_type, addr, eve_ctx);
961 SCJbSetUint(js,
"tx_id", tx_id);
983 json_object_set_new(js,
"host",
1032 MemBufferReset(*buffer);
1038 size_t jslen = SCJbLen(js);
1041 if (jslen >= remaining) {
1042 size_t expand_by = jslen + 1 - remaining;
1044 if (!
ctx->too_large_warning) {
1048 size_t partial_len =
MIN(
sizeof(partial), jslen);
1049 memcpy(partial, SCJbPtr(js), partial_len - 1);
1050 partial[partial_len - 1] =
'\0';
1051 SCLogWarning(
"Formatted JSON EVE record too large, will be dropped: %s", partial);
1052 ctx->too_large_warning =
true;
1062 static inline enum LogFileType FileTypeFromConf(
const char *typestr)
1066 if (typestr == NULL) {
1068 }
else if (strcmp(typestr,
"file") == 0 || strcmp(typestr,
"regular") == 0) {
1070 }
else if (strcmp(typestr,
"unix_dgram") == 0) {
1072 }
else if (strcmp(typestr,
"unix_stream") == 0) {
1074 }
else if (strcmp(typestr,
"redis") == 0) {
1075 #ifdef HAVE_LIBHIREDIS
1078 FatalError(
"redis JSON output option is not compiled");
1081 SCLogDebug(
"type %s, file type value %d", typestr, log_filetype);
1082 return log_filetype;
1085 static int LogFileTypePrepare(
1095 #ifdef HAVE_LIBHIREDIS
1100 char hostname[1024];
1101 gethostname(hostname, 1023);
1108 if (SCConfLogOpenRedis(redis_node, json_ctx->
file_ctx) < 0) {
1148 SCLogDebug(
"could not create new OutputJsonCtx");
1155 if (sensor_name != NULL) {
1156 SCLogWarning(
"Found deprecated eve-log setting \"sensor-name\". "
1157 "Please set sensor-name globally.");
1160 (void)
SCConfGet(
"sensor-name", &sensor_name);
1165 SCLogDebug(
"AlertJsonInitCtx: Could not create new LogFileCtx");
1179 if (
unlikely(output_ctx == NULL)) {
1183 output_ctx->
data = json_ctx;
1184 output_ctx->
DeInit = OutputJsonDeInitCtx;
1189 if (output_s == NULL) {
1193 enum LogFileType log_filetype = FileTypeFromConf(output_s);
1196 if (filetype != NULL) {
1200 FatalError(
"Invalid JSON output option: %s", output_s);
1206 SCLogInfo(
"Using prefix '%s' for JSON messages", prefix);
1210 FatalError(
"Failed to allocate memory for eve-log.prefix setting.");
1223 if (LogFileTypePrepare(json_ctx, log_filetype, conf) < 0) {
1228 if (sensor_id_s != NULL) {
1230 FatalError(
"Failed to initialize JSON output, "
1231 "invalid sensor-id: %s",
1248 SCLogConfig(
"Enabling Ethernet MAC address logging.");
1256 SCLogConfig(
"Enabling Suricata version logging.");
1265 SCLogConfig(
"Enabling eve community_id logging.");
1271 if (cid_seed != NULL) {
1273 10, 0, cid_seed) < 0)
1275 FatalError(
"Failed to initialize JSON output, "
1276 "invalid community-id-seed: %s",
1298 SCLogDebug(
"returning output_ctx %p", output_ctx);
1300 result.
ctx = output_ctx;
1319 static void OutputJsonDeInitCtx(
OutputCtx *output_ctx)
1323 if (logfile_ctx->dropped) {
1324 SCLogWarning(
"%" PRIu64
" events were dropped due to slow or "
1325 "disconnected socket",
1326 logfile_ctx->dropped);
1328 if (json_ctx->
xff_cfg != NULL) {
#define PKT_IS_TOCLIENT(p)
FlowVarTypeFloat fv_float
struct Flow_::@129::@135 icmp_s
void OutputJsonFlush(OutputJsonThreadCtx *ctx)
int SCConfValIsTrue(const char *val)
Check if a value is true.
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
OutputJsonCommonSettings cfg
void HttpXFFGetCfg(SCConfNode *conf, HttpXFFCfg *result)
Function to return XFF configuration from a configuration node.
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
int MemBufferExpand(MemBuffer **buffer, uint32_t expand_by)
expand membuffer by size of 'expand_by'
void LogFileFlush(LogFileCtx *file_ctx)
SCJsonBuilder * CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
#define JSON_OUTPUT_BUFFER_SIZE
int StringParseUint16(uint16_t *res, int base, size_t len, const char *str)
int SCConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
void EveTcpFlags(const uint8_t flags, SCJsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
const JsonAddrInfo json_addr_info_zero
#define COMMUNITY_ID_BUF_SIZE
bool include_community_id
int SCConfValIsFalse(const char *val)
Check if a value is false.
const char * known_proto[256]
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f)
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
struct Packet_::@33::@40 icmp_s
struct JSONMACAddrInfo JSONMACAddrInfo
uint8_t sha1[SC_SHA1_LEN]
#define GET_IPV6_DST_ADDR(p)
json_t * SCJsonString(const char *val)
bool include_suricata_version
void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, const uint32_t src_buf_len)
void OutputJsonRegister(void)
size_t strlcpy(char *dst, const char *src, size_t siz)
enum @22 __attribute__
DNP3 application header.
void JsonAddrInfoInit(const Packet *p, enum SCOutputJsonLogDirection dir, JsonAddrInfo *addr)
SCRunMode SCRunmodeGet(void)
Get the current run mode.
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
#define JB_SET_STRING(jb, key, val)
struct GenericVar_ * next
#define GET_IPV4_DST_ADDR_PTR(p)
#define PKT_IS_TOSERVER(p)
#define DEFAULT_LOG_FILENAME
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, SCJsonBuilder *js, enum SCOutputJsonLogDirection dir)
void OutputRegisterModule(const char *, const char *, OutputInitFunc)
OutputInitResult OutputJsonInitCtx(SCConfNode *conf)
Create a new LogFileCtx for "fast" output style.
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
uint64_t FileTrackedSize(const File *file)
get the size of the file
const char * PktSrcToString(enum PktSrcEnum pkt_src)
#define JB_SET_TRUE(jb, key)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void SyslogInitialize(void)
void NullLogInitialize(void)
void EveFileInfo(SCJsonBuilder *jb, const File *ff, const uint64_t tx_id, const uint16_t flags)
void JSONFormatAndAddMACAddr(SCJsonBuilder *js, const char *key, const uint8_t *val, bool is_array)
struct LiveDevice_ * livedev
@ LOGFILE_TYPE_UNIX_DGRAM
FlowStorageId MacSetGetFlowStorageID(void)
bool SCLogOpenThreadedFile(const char *log_path, const char *append, LogFileCtx *parent_ctx)
union FlowVar_::@124 data
@ LOGFILE_TYPE_UNIX_STREAM
void EvePacket(const Packet *p, SCJsonBuilder *js, uint32_t max_length)
Jsonify a packet.
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void EveAddMetadata(const Packet *p, const Flow *f, SCJsonBuilder *js)
int(* Init)(const SCConfNode *conf, const bool threaded, void **init_data)
Function to initialize this filetype.
char proto[JSON_PROTO_LEN]
SCConfNode * SCConfNodeLookupChild(const SCConfNode *node, const char *name)
Lookup a child configuration node by name.
int StringParseUint64(uint64_t *res, int base, size_t len, const char *str)
#define GET_IPV4_SRC_ADDR_PTR(p)
#define PrintBufferData(buf, buf_offset_ptr, buf_size,...)
void(* DeInit)(struct OutputCtx_ *)
const char * VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
find name for id+type at packet time.
int MacSetSize(const MacSet *ms)
#define FLOWVAR_TYPE_FLOAT
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
SCJsonBuilder * CreateEveHeaderWithTxId(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx)
struct Flow_::@131::@137 icmp_d
uint8_t sha256[SC_SHA256_LEN]
#define JB_SET_FALSE(jb, key)
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
char src_ip[JSON_ADDR_LEN]
int SCConfLogOpenGeneric(SCConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
#define GET_IPV6_SRC_ADDR(p)
uint8_t * MacSetGetFirst(const MacSet *ms, MacSetSide side)
#define MEMBUFFER_SIZE(mem_buffer)
Get the MemBuffers current size.
int MacSetForEach(const MacSet *ms, MacSetIteratorFunc IterFunc, void *data)
char dst_ip[JSON_ADDR_LEN]
const char * PcapFileGetFilename(void)
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data)
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
uint32_t MemBufferWriteRaw(MemBuffer *dst, const uint8_t *raw, const uint32_t raw_len)
Write a raw buffer to the MemBuffer dst.
SCEveFileType * SCEveFindFileType(const char *name)
uint16_t vlan_id[VLAN_MAX_LAYERS]
int(* ThreadInit)(const void *init_data, const ThreadId thread_id, void **thread_data)
Initialize thread specific data.
uint16_t community_id_seed
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
const char * DatalinkValueToName(int datalink_value)
#define DEBUG_VALIDATE_BUG_ON(exp)
void SCEveRunCallbacks(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *jb)
Structure used to define an EVE output file type plugin.