Go to the documentation of this file.
71 SCLogNotice(
"%s logger not enabled: protocol %s is disabled",
78 memset(op, 0x00,
sizeof(*op));
117 if (t->
id * 2 > UINT32_MAX) {
129 Flow *f,
void *tx,
const uint64_t tx_id)
138 while (logger && store) {
149 logger = logger->
next;
166 const uint8_t ipproto = f->
proto;
177 if (logger_expectation == 0)
181 if (alstate == NULL) {
193 uint64_t max_id = tx_id;
199 memset(&state, 0,
sizeof(state));
202 AppLayerGetTxIterTuple ires = IterFunc(ipproto,
alproto, alstate, tx_id, total_txs, &state);
203 if (ires.tx_ptr == NULL)
205 void *
const tx = ires.tx_ptr;
217 OutputTxLogList0(
tv, op_thread_data, p, f, tx, tx_id);
222 SCLogDebug(
"tx %p/%"PRIu64
" txd %p: log_flags %x", tx, tx_id, txd, txd->config.log_flags);
228 LoggerId tx_logged = txd->logged.flags;
229 const LoggerId tx_logged_old = tx_logged;
230 SCLogDebug(
"logger: expect %08x, have %08x", logger_expectation, tx_logged);
231 if (tx_logged == logger_expectation) {
236 const int tx_progress_ts =
238 const int tx_progress_tc =
240 SCLogDebug(
"tx_progress_ts %d tx_progress_tc %d",
241 tx_progress_ts, tx_progress_tc);
250 while (logger && store) {
254 SCLogDebug(
"logger %p, Alproto %d LogCondition %p, ts_log_progress %d "
260 SCLogDebug(
"pcap_cnt %"PRIu64
", tx_id %"PRIu64
" logger %d. "
261 "EOFs TS %s TC %s LAST PSEUDO %s",
263 ts_eof ?
"true" :
"false", tc_eof ?
"true" :
"false",
264 last_pseudo ?
"true" :
"false");
266 if ((ts_eof && tc_eof) || last_pseudo) {
272 SCLogDebug(
"conditions not met, not logging");
277 SCLogDebug(
"progress not far enough, not logging");
282 SCLogDebug(
"progress not far enough, not logging");
297 logger = logger->
next;
304 if (tx_logged != tx_logged_old) {
306 tx_logged, tx_logged_old);
308 txd->logged.flags |= tx_logged;
317 if (!gap && tx_logged == logger_expectation) {
332 SCLogDebug(
"updating log tx_id %"PRIu64, max_id);
348 memset(td, 0x00,
sizeof(*td));
351 SCLogDebug(
"OutputTxLogThreadInit happy (*data %p)", *data);
361 memset(
ts, 0x00,
sizeof(*
ts));
364 ts->thread_data = retptr;
370 while (tmp->
next != NULL)
379 logger = logger->
next;
393 while (logger && store) {
401 logger = logger->
next;
409 static void OutputTxLogExitPrintStats(
ThreadVars *
tv,
void *thread_data)
417 while (logger && store) {
422 logger = logger->
next;
428 static uint32_t OutputTxLoggerGetActiveCount(
void)
443 OutputTxLogExitPrintStats, OutputTxLog, OutputTxLoggerGetActiveCount);
453 logger = next_logger;
OutputLoggerThreadStore * store[ALPROTO_MAX]
struct OutputLoggerThreadStore_ * next
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
void OutputTxLoggerRegister(void)
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
#define FLOW_PKT_LAST_PSEUDO
void OutputTxShutdown(void)
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
int(* TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
#define APP_LAYER_PARSER_EOF_TS
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
struct OutputTxLoggerThreadData_ OutputTxLoggerThreadData
AppLayerParserState * alparser
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
struct OutputTxLogger_ * next
Per thread variable structure.
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
#define APP_LAYER_PARSER_EOF_TC
TxLoggerCondition LogCondition
void(* ThreadExitPrintStats)(ThreadVars *, void *)
#define PACKET_PROFILING_LOGGER_END(p, id)
struct OutputTxLogger_ OutputTxLogger
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
#define FatalError(x,...)
int(* TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id)
#define PACKET_PROFILING_LOGGER_START(p, id)
void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
#define SCLogNotice(...)
Macro used to log NOTICE messages.
AppProto alproto
application level protocol
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
#define DEBUG_VALIDATE_BUG_ON(exp)
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)