suricata
output.c File Reference
#include "suricata-common.h"
#include "flow.h"
#include "conf.h"
#include "tm-threads.h"
#include "util-error.h"
#include "util-debug.h"
#include "output.h"
#include "alert-fastlog.h"
#include "alert-debuglog.h"
#include "alert-syslog.h"
#include "output-json.h"
#include "output-json-alert.h"
#include "output-json-anomaly.h"
#include "output-json-flow.h"
#include "output-json-netflow.h"
#include "log-cf-common.h"
#include "output-json-drop.h"
#include "output-eve-stream.h"
#include "log-httplog.h"
#include "output-json-http.h"
#include "output-json-dns.h"
#include "log-tlslog.h"
#include "log-tlsstore.h"
#include "output-json-tls.h"
#include "log-pcap.h"
#include "app-layer-ssh.h"
#include "output-json-file.h"
#include "output-json-smtp.h"
#include "output-json-stats.h"
#include "log-tcp-data.h"
#include "log-stats.h"
#include "output-json-nfs.h"
#include "output-json-ftp.h"
#include "app-layer-ftp.h"
#include "output-json-smb.h"
#include "output-json-ike.h"
#include "output-json-dhcp.h"
#include "output-json-mqtt.h"
#include "output-json-pgsql.h"
#include "output-lua.h"
#include "output-json-dnp3.h"
#include "output-json-metadata.h"
#include "output-json-dcerpc.h"
#include "output-json-frame.h"
#include "app-layer-parser.h"
#include "output-filestore.h"
#include "output-json-arp.h"
Include dependency graph for output.c:

Go to the source code of this file.

Data Structures

struct  RootLogger_
 

Typedefs

typedef struct RootLogger_ RootLogger
 

Functions

typedef TAILQ_HEAD (LoggerThreadStore_, LoggerThreadStoreNode_)
 
 TAILQ_HEAD (OutputFileRolloverFlag_)
 
void OutputRegisterPacketModule (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a packet output module. More...
 
void OutputRegisterPacketSubModule (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a packet output sub-module. More...
 
void OutputRegisterTxModuleWithCondition (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a tx output module with condition. More...
 
void OutputRegisterTxSubModuleWithCondition (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 
void OutputRegisterTxModuleWithProgress (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a tx output module with progress. More...
 
void OutputRegisterTxSubModuleWithProgress (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 
void OutputRegisterTxModule (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a tx output module. More...
 
void OutputRegisterTxSubModule (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 
void OutputRegisterFileSubModule (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a file output sub-module. More...
 
void OutputRegisterFiledataModule (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a file data output module. More...
 
void OutputRegisterFlowSubModule (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a flow output sub-module. More...
 
void OutputRegisterStreamingModule (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc, enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a streaming data output module. More...
 
void OutputRegisterStatsModule (LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a stats data output module. More...
 
void OutputRegisterStatsSubModule (LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
 Register a stats data output sub-module. More...
 
OutputModuleOutputGetModuleByConfName (const char *conf_name)
 Get an output module by name. More...
 
void OutputDeregisterAll (void)
 Deregister all modules. Useful for a memory clean exit. More...
 
int OutputDropLoggerEnable (void)
 
void OutputDropLoggerDisable (void)
 
void OutputRegisterFileRotationFlag (int *flag)
 Register a flag for file rotation notification. More...
 
void OutputUnregisterFileRotationFlag (int *flag)
 Unregister a file rotation flag. More...
 
void OutputNotifyFileRotation (void)
 Notifies all registered file rotation notification flags. More...
 
TmEcode OutputLoggerLog (ThreadVars *tv, Packet *p, void *thread_data)
 
TmEcode OutputLoggerThreadInit (ThreadVars *tv, const void *initdata, void **data)
 
TmEcode OutputLoggerThreadDeinit (ThreadVars *tv, void *thread_data)
 
void OutputRegisterRootLogger (ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
 
void OutputSetupActiveLoggers (void)
 
void OutputClearActiveLoggers (void)
 
void TmModuleLoggerRegister (void)
 
EveJsonSimpleAppLayerLoggerSCEveJsonSimpleGetLogger (AppProto alproto)
 
void OutputRegisterRootLoggers (void)
 Register all root loggers. More...
 
void OutputRegisterLoggers (void)
 Register all non-root logging modules. More...
 

Variables

 LoggerThreadStoreNode
 
 OutputFileRolloverFlag
 

Detailed Description

Author
OISF, Jason Ish jason.nosp@m..ish.nosp@m.@oisf.nosp@m..net
Endace Technology Limited, Jason Ish jason.nosp@m..ish.nosp@m.@enda.nosp@m.ce.c.nosp@m.om

The root logging output for all non-application logging.

The loggers are made up of a hierarchy of loggers. At the top we have the root logger which is the main entry point to logging. Under the root there exists parent loggers that are the entry point for specific types of loggers such as packet logger, transaction loggers, etc. Each parent logger may have 0 or more loggers that actual handle the job of producing output to something like a file.

Definition in file output.c.

Typedef Documentation

◆ RootLogger

typedef struct RootLogger_ RootLogger

Function Documentation

◆ OutputClearActiveLoggers()

void OutputClearActiveLoggers ( void  )

Definition at line 821 of file output.c.

References SCFree, TAILQ_FIRST, and TAILQ_REMOVE.

◆ OutputDeregisterAll()

void OutputDeregisterAll ( void  )

Deregister all modules. Useful for a memory clean exit.

Definition at line 629 of file output.c.

References output_modules, SCFree, TAILQ_FIRST, and TAILQ_REMOVE.

Referenced by GlobalsDestroy().

Here is the caller graph for this function:

◆ OutputDropLoggerDisable()

void OutputDropLoggerDisable ( void  )

Definition at line 651 of file output.c.

◆ OutputDropLoggerEnable()

int OutputDropLoggerEnable ( void  )

Definition at line 643 of file output.c.

◆ OutputGetModuleByConfName()

OutputModule* OutputGetModuleByConfName ( const char *  conf_name)

Get an output module by name.

Return values
TheOutputModule with the given name or NULL if no output module with the given name is registered.

Definition at line 612 of file output.c.

References OutputModule_::conf_name, output_modules, and TAILQ_FOREACH.

◆ OutputLoggerLog()

TmEcode OutputLoggerLog ( ThreadVars tv,
Packet p,
void *  thread_data 
)

Definition at line 708 of file output.c.

◆ OutputLoggerThreadDeinit()

TmEcode OutputLoggerThreadDeinit ( ThreadVars tv,
void *  thread_data 
)

Definition at line 753 of file output.c.

References TM_ECODE_FAILED.

◆ OutputLoggerThreadInit()

TmEcode OutputLoggerThreadInit ( ThreadVars tv,
const void *  initdata,
void **  data 
)

Definition at line 722 of file output.c.

◆ OutputNotifyFileRotation()

void OutputNotifyFileRotation ( void  )

Notifies all registered file rotation notification flags.

Definition at line 701 of file output.c.

References OutputFileRolloverFlag, and TAILQ_FOREACH.

Referenced by SuricataMainLoop().

Here is the caller graph for this function:

◆ OutputRegisterFiledataModule()

void OutputRegisterFiledataModule ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
SCFiledataLogger  FiledataLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a file data output module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 430 of file output.c.

Referenced by OutputFilestoreRegister().

Here is the caller graph for this function:

◆ OutputRegisterFileRotationFlag()

void OutputRegisterFileRotationFlag ( int *  flag)

Register a flag for file rotation notification.

Parameters
flagA pointer that will be set to 1 when file rotation is requested.

Definition at line 663 of file output.c.

References OutputFileRolloverFlag, SCCalloc, SCLogError, TAILQ_INSERT_TAIL, and unlikely.

◆ OutputRegisterFileSubModule()

void OutputRegisterFileSubModule ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
SCFileLogger  FileLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a file output sub-module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 393 of file output.c.

Referenced by JsonFileLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterFlowSubModule()

void OutputRegisterFlowSubModule ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
FlowLogger  FlowLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a flow output sub-module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 466 of file output.c.

Referenced by JsonFlowLogRegister(), and JsonNetFlowLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterLoggers()

void OutputRegisterLoggers ( void  )

◆ OutputRegisterPacketModule()

void OutputRegisterPacketModule ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
PacketLogger  PacketLogFunc,
PacketLogCondition  PacketConditionFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a packet output module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 169 of file output.c.

Referenced by AlertDebugLogRegister(), AlertFastLogRegister(), AlertSyslogRegister(), and PcapLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterPacketSubModule()

void OutputRegisterPacketSubModule ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
PacketLogger  PacketLogFunc,
PacketLogCondition  PacketConditionFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a packet output sub-module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 206 of file output.c.

Referenced by EveStreamLogRegister(), JsonAlertLogRegister(), JsonAnomalyLogRegister(), JsonArpLogRegister(), JsonDropLogRegister(), JsonFrameLogRegister(), and JsonMetadataLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterRootLogger()

void OutputRegisterRootLogger ( ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit,
OutputLogFunc  LogFunc,
OutputGetActiveCountFunc  ActiveCntFunc 
)

Definition at line 779 of file output.c.

Referenced by OutputPacketLoggerRegister(), and OutputStreamingLoggerRegister().

Here is the caller graph for this function:

◆ OutputRegisterRootLoggers()

void OutputRegisterRootLoggers ( void  )

Register all root loggers.

Definition at line 858 of file output.c.

Referenced by TmModuleLoggerRegister().

Here is the caller graph for this function:

◆ OutputRegisterStatsModule()

void OutputRegisterStatsModule ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
StatsLogger  StatsLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a stats data output module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 541 of file output.c.

Referenced by LogStatsLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterStatsSubModule()

void OutputRegisterStatsSubModule ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
StatsLogger  StatsLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a stats data output sub-module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 577 of file output.c.

Referenced by JsonStatsLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterStreamingModule()

void OutputRegisterStreamingModule ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
SCStreamingLogger  StreamingLogFunc,
enum SCOutputStreamingType  stream_type,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a streaming data output module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 503 of file output.c.

Referenced by LogTcpDataLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterTxModule()

void OutputRegisterTxModule ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
AppProto  alproto,
TxLogger  TxLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a tx output module.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 369 of file output.c.

Referenced by LogHttpLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterTxModuleWithCondition()

void OutputRegisterTxModuleWithCondition ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
AppProto  alproto,
TxLogger  TxLogFunc,
TxLoggerCondition  TxLogCondition,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a tx output module with condition.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 320 of file output.c.

Referenced by LogTlsStoreRegister().

Here is the caller graph for this function:

◆ OutputRegisterTxModuleWithProgress()

void OutputRegisterTxModuleWithProgress ( LoggerId  id,
const char *  name,
const char *  conf_name,
OutputInitFunc  InitFunc,
AppProto  alproto,
TxLogger  TxLogFunc,
int  tc_log_progress,
int  ts_log_progress,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Register a tx output module with progress.

This function will register an output module so it can be configured with the configuration file.

Return values
Returns0 on success, -1 on failure.

Definition at line 344 of file output.c.

Referenced by LogTlsLogRegister().

Here is the caller graph for this function:

◆ OutputRegisterTxSubModule()

void OutputRegisterTxSubModule ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
AppProto  alproto,
TxLogger  TxLogFunc,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

◆ OutputRegisterTxSubModuleWithCondition()

void OutputRegisterTxSubModuleWithCondition ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
AppProto  alproto,
TxLogger  TxLogFunc,
TxLoggerCondition  TxLogCondition,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Definition at line 328 of file output.c.

◆ OutputRegisterTxSubModuleWithProgress()

void OutputRegisterTxSubModuleWithProgress ( LoggerId  id,
const char *  parent_name,
const char *  name,
const char *  conf_name,
OutputInitSubFunc  InitFunc,
AppProto  alproto,
TxLogger  TxLogFunc,
int  tc_log_progress,
int  ts_log_progress,
ThreadInitFunc  ThreadInit,
ThreadDeinitFunc  ThreadDeinit 
)

Definition at line 352 of file output.c.

Referenced by JsonTlsLogRegister(), and OutputRegisterLoggers().

Here is the caller graph for this function:

◆ OutputSetupActiveLoggers()

void OutputSetupActiveLoggers ( void  )

Definition at line 808 of file output.c.

References RootLogger_::ActiveCntFunc, cnt, and TAILQ_FIRST.

◆ OutputUnregisterFileRotationFlag()

void OutputUnregisterFileRotationFlag ( int *  flag)

Unregister a file rotation flag.

Note that it is safe to call this function with a flag that may not have been registered, in which case this function won't do anything.

Parameters
flagA pointer that has been previously registered for file rotation notifications.

Definition at line 684 of file output.c.

References next, OutputFileRolloverFlag, SCFree, TAILQ_FIRST, TAILQ_NEXT, and TAILQ_REMOVE.

Referenced by LogFileFreeCtx().

Here is the caller graph for this function:

◆ SCEveJsonSimpleGetLogger()

EveJsonSimpleAppLayerLogger* SCEveJsonSimpleGetLogger ( AppProto  alproto)

Definition at line 836 of file output.c.

References ALPROTO_MAX.

◆ TAILQ_HEAD() [1/2]

typedef TAILQ_HEAD ( LoggerThreadStore_  ,
LoggerThreadStoreNode_   
)

Registry of flags to be updated on file rotation notification.

Definition at line 111 of file output.c.

◆ TAILQ_HEAD() [2/2]

TAILQ_HEAD ( OutputFileRolloverFlag_  )

Definition at line 127 of file output.c.

◆ TmModuleLoggerRegister()

void TmModuleLoggerRegister ( void  )

Definition at line 830 of file output.c.

References OutputRegisterLoggers(), and OutputRegisterRootLoggers().

Referenced by RegisterAllModules().

Here is the call graph for this function:
Here is the caller graph for this function:

Variable Documentation

◆ LoggerThreadStoreNode

LoggerThreadStoreNode

Definition at line 109 of file output.c.

◆ OutputFileRolloverFlag

OutputFileRolloverFlag