suricata
output.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author OISF, Jason Ish <jason.ish@oisf.net>
22  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
23  *
24  * The root logging output for all non-application logging.
25  *
26  * The loggers are made up of a hierarchy of loggers. At the top we
27  * have the root logger which is the main entry point to
28  * logging. Under the root there exists parent loggers that are the
29  * entry point for specific types of loggers such as packet logger,
30  * transaction loggers, etc. Each parent logger may have 0 or more
31  * loggers that actual handle the job of producing output to something
32  * like a file.
33  */
34 
35 #include "suricata-common.h"
36 #include "flow.h"
37 #include "conf.h"
38 #include "tm-threads.h"
39 #include "util-error.h"
40 #include "util-debug.h"
41 #include "output.h"
42 #include "output-eve-bindgen.h"
43 
44 #include "alert-fastlog.h"
45 #include "alert-debuglog.h"
46 #include "alert-syslog.h"
47 #include "output-json.h"
48 #include "output-json-alert.h"
49 #include "output-json-anomaly.h"
50 #include "output-json-flow.h"
51 #include "output-json-netflow.h"
52 #include "log-cf-common.h"
53 #include "output-json-drop.h"
54 #include "output-eve-stream.h"
55 #include "log-httplog.h"
56 #include "output-json-http.h"
57 #include "output-json-dns.h"
58 #include "output-json-mdns.h"
59 #include "log-tlslog.h"
60 #include "log-tlsstore.h"
61 #include "output-json-tls.h"
62 #include "log-pcap.h"
63 // for SSHTxLogCondition
64 #include "app-layer-ssh.h"
65 #include "output-json-file.h"
66 #include "output-json-smtp.h"
67 #include "output-json-stats.h"
68 #include "log-tcp-data.h"
69 #include "log-stats.h"
70 #include "output-json-nfs.h"
71 #include "output-json-ftp.h"
72 // for misplaced EveFTPDataAddMetadata
73 #include "app-layer-ftp.h"
74 #include "output-json-smb.h"
75 #include "output-json-ike.h"
76 #include "output-json-dhcp.h"
77 #include "output-json-mqtt.h"
78 #include "output-json-pgsql.h"
79 #include "output-lua.h"
80 #include "output-json-dnp3.h"
81 #include "output-json-metadata.h"
82 #include "output-json-dcerpc.h"
83 #include "output-json-frame.h"
84 #include "app-layer-parser.h"
85 #include "output-filestore.h"
86 #include "output-json-arp.h"
87 
88 typedef struct RootLogger_ {
94 
95  TAILQ_ENTRY(RootLogger_) entries;
97 
98 /* List of registered root loggers. These are registered at start up and
99  * are independent of configuration. Later we will build a list of active
100  * loggers based on configuration. */
101 static TAILQ_HEAD(, RootLogger_) registered_loggers =
102  TAILQ_HEAD_INITIALIZER(registered_loggers);
103 
104 /* List of active root loggers. This means that at least one logger is enabled
105  * for each root logger type in the config. */
106 static TAILQ_HEAD(, RootLogger_) active_loggers =
107  TAILQ_HEAD_INITIALIZER(active_loggers);
108 
109 typedef struct LoggerThreadStoreNode_ {
110  void *thread_data;
111  TAILQ_ENTRY(LoggerThreadStoreNode_) entries;
113 
114 typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_) LoggerThreadStore;
115 
116 /**
117  * The list of all registered (known) output modules.
118  */
120 
121 /**
122  * Registry of flags to be updated on file rotation notification.
123  */
124 typedef struct OutputFileRolloverFlag_ {
125  int *flag;
126 
127  TAILQ_ENTRY(OutputFileRolloverFlag_) entries;
129 
130 static SCMutex output_file_rotation_mutex = SCMUTEX_INITIALIZER;
131 
132 TAILQ_HEAD(, OutputFileRolloverFlag_) output_file_rotation_flags =
133  TAILQ_HEAD_INITIALIZER(output_file_rotation_flags);
134 
135 /**
136  * Callback function to be called when logging is ready.
137  */
138 typedef void (*SCOnLoggingReadyCallback)(void *arg);
139 
140 /**
141  * List entries for callbacks registered to be called when the logging system is
142  * ready. This is useful for both plugins and library users who need to register
143  * application transaction loggers after logging initialization is complete.
144  */
145 typedef struct OnLoggingReadyCallbackNode_ {
146  SCOnLoggingReadyCallback callback;
147  void *arg;
148  TAILQ_ENTRY(OnLoggingReadyCallbackNode_) entries;
150 
151 /**
152  * The list of callbacks to be called when logging is ready.
153  */
154 static TAILQ_HEAD(, OnLoggingReadyCallbackNode_)
155  on_logging_ready_callbacks = TAILQ_HEAD_INITIALIZER(on_logging_ready_callbacks);
156 
157 void OutputRegisterRootLoggers(void);
158 void OutputRegisterLoggers(void);
159 
160 /**
161  * \brief Register an output module.
162  *
163  * This function will register an output module so it can be
164  * configured with the configuration file.
165  *
166  * \retval Returns 0 on success, -1 on failure.
167  */
168 void OutputRegisterModule(const char *name, const char *conf_name,
169  OutputInitFunc InitFunc)
170 {
171  OutputModule *module = SCCalloc(1, sizeof(*module));
172  if (unlikely(module == NULL))
173  goto error;
174 
175  module->name = name;
176  module->conf_name = conf_name;
177  module->InitFunc = InitFunc;
178  TAILQ_INSERT_TAIL(&output_modules, module, entries);
179 
180  SCLogDebug("Output module \"%s\" registered.", name);
181 
182  return;
183 
184 error:
185  FatalError("Fatal error encountered in OutputRegisterModule. Exiting...");
186 }
187 
188 /**
189  * \brief Register a packet output module.
190  *
191  * This function will register an output module so it can be
192  * configured with the configuration file.
193  *
194  * \retval Returns 0 on success, -1 on failure.
195  */
196 void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name,
197  OutputInitFunc InitFunc, OutputPacketLoggerFunctions *output_module_functions)
198 {
199  if (unlikely(output_module_functions->LogFunc == NULL ||
200  output_module_functions->ConditionFunc == NULL)) {
201  goto error;
202  }
203 
204  OutputModule *module = SCCalloc(1, sizeof(*module));
205  if (unlikely(module == NULL)) {
206  goto error;
207  }
208 
209  module->logger_id = id;
210  module->name = name;
211  module->conf_name = conf_name;
212  module->InitFunc = InitFunc;
213  module->PacketLogFunc = output_module_functions->LogFunc;
214  module->PacketFlushFunc = output_module_functions->FlushFunc;
215  module->PacketConditionFunc = output_module_functions->ConditionFunc;
216  module->ThreadInit = output_module_functions->ThreadInitFunc;
217  module->ThreadDeinit = output_module_functions->ThreadDeinitFunc;
218  TAILQ_INSERT_TAIL(&output_modules, module, entries);
219 
220  SCLogDebug("Packet logger \"%s\" registered.", name);
221  return;
222 error:
223  FatalError("Fatal error encountered. Exiting...");
224 }
225 
226 /**
227  * \brief Register a packet output sub-module.
228  *
229  * This function will register an output module so it can be
230  * configured with the configuration file.
231  *
232  * \retval Returns 0 on success, -1 on failure.
233  */
234 void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name,
235  const char *conf_name, OutputInitSubFunc InitFunc,
236  OutputPacketLoggerFunctions *output_logger_functions)
237 {
238  if (unlikely(output_logger_functions->LogFunc == NULL ||
239  output_logger_functions->ConditionFunc == NULL)) {
240  goto error;
241  }
242 
243  OutputModule *module = SCCalloc(1, sizeof(*module));
244  if (unlikely(module == NULL)) {
245  goto error;
246  }
247 
248  module->logger_id = id;
249  module->name = name;
250  module->conf_name = conf_name;
251  module->parent_name = parent_name;
252  module->InitSubFunc = InitFunc;
253  module->PacketLogFunc = output_logger_functions->LogFunc;
254  module->PacketFlushFunc = output_logger_functions->FlushFunc;
255  module->PacketConditionFunc = output_logger_functions->ConditionFunc;
256  module->ThreadInit = output_logger_functions->ThreadInitFunc;
257  module->ThreadDeinit = output_logger_functions->ThreadDeinitFunc;
258  TAILQ_INSERT_TAIL(&output_modules, module, entries);
259 
260  SCLogDebug("Packet logger \"%s\" registered.", name);
261  return;
262 error:
263  FatalError("Fatal error encountered. Exiting...");
264 }
265 
266 /**
267  * \brief Wrapper function for tx output modules.
268  *
269  * This function will register an output module so it can be
270  * configured with the configuration file.
271  *
272  * \retval Returns 0 on success, -1 on failure.
273  */
274 static void OutputRegisterTxModuleWrapper(LoggerId id, const char *name, const char *conf_name,
275  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress,
276  int ts_log_progress, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit,
277  ThreadDeinitFunc ThreadDeinit)
278 {
279  if (unlikely(TxLogFunc == NULL)) {
280  goto error;
281  }
282 
283  OutputModule *module = SCCalloc(1, sizeof(*module));
284  if (unlikely(module == NULL)) {
285  goto error;
286  }
287 
288  module->logger_id = id;
289  module->name = name;
290  module->conf_name = conf_name;
291  module->InitFunc = InitFunc;
292  module->TxLogFunc = TxLogFunc;
293  module->TxLogCondition = TxLogCondition;
294  module->alproto = alproto;
295  module->tc_log_progress = tc_log_progress;
296  module->ts_log_progress = ts_log_progress;
297  module->ThreadInit = ThreadInit;
298  module->ThreadDeinit = ThreadDeinit;
299  TAILQ_INSERT_TAIL(&output_modules, module, entries);
300 
301  SCLogDebug("Tx logger \"%s\" registered.", name);
302  return;
303 error:
304  FatalError("Fatal error encountered. Exiting...");
305 }
306 
307 static void OutputRegisterTxSubModuleWrapper(LoggerId id, const char *parent_name, const char *name,
308  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
309  int tc_log_progress, int ts_log_progress, TxLoggerCondition TxLogCondition,
310  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
311 {
312  if (unlikely(TxLogFunc == NULL)) {
313  goto error;
314  }
315 
316  OutputModule *module = SCCalloc(1, sizeof(*module));
317  if (unlikely(module == NULL)) {
318  goto error;
319  }
320 
321  module->logger_id = id;
322  module->name = name;
323  module->conf_name = conf_name;
324  module->parent_name = parent_name;
325  module->InitSubFunc = InitFunc;
326  module->TxLogFunc = TxLogFunc;
327  module->TxLogCondition = TxLogCondition;
328  module->alproto = alproto;
329  module->tc_log_progress = tc_log_progress;
330  module->ts_log_progress = ts_log_progress;
331  module->ThreadInit = ThreadInit;
332  module->ThreadDeinit = ThreadDeinit;
333  TAILQ_INSERT_TAIL(&output_modules, module, entries);
334 
335  SCLogDebug("Tx logger for alproto %d \"%s\" registered.", alproto, name);
336  return;
337 error:
338  FatalError("Fatal error encountered. Exiting...");
339 }
340 
341 /**
342  * \brief Register a tx output module with condition.
343  *
344  * This function will register an output module so it can be
345  * configured with the configuration file.
346  *
347  * \retval Returns 0 on success, -1 on failure.
348  */
349 void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name,
350  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
351  TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
352 {
353  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1,
354  TxLogCondition, ThreadInit, ThreadDeinit);
355 }
356 
357 void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name,
358  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
359  TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
360 {
361  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
362  -1, -1, TxLogCondition, ThreadInit, ThreadDeinit);
363 }
364 
365 /**
366  * \brief Register a tx output module with progress.
367  *
368  * This function will register an output module so it can be
369  * configured with the configuration file.
370  *
371  * \retval Returns 0 on success, -1 on failure.
372  */
373 void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name,
374  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress,
375  int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
376 {
377  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc,
378  tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit);
379 }
380 
381 void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name,
382  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
383  int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit,
384  ThreadDeinitFunc ThreadDeinit)
385 {
386  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
387  tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit);
388 }
389 
390 /**
391  * \brief Register a tx output module.
392  *
393  * This function will register an output module so it can be
394  * configured with the configuration file.
395  *
396  * \retval Returns 0 on success, -1 on failure.
397  */
398 void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name,
399  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit,
400  ThreadDeinitFunc ThreadDeinit)
401 {
402  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, NULL,
403  ThreadInit, ThreadDeinit);
404 }
405 
406 void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name,
407  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
408  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
409 {
410  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
411  -1, -1, NULL, ThreadInit, ThreadDeinit);
412 }
413 
414 /**
415  * \brief Register a file output sub-module.
416  *
417  * This function will register an output module so it can be
418  * configured with the configuration file.
419  *
420  * \retval Returns 0 on success, -1 on failure.
421  */
422 void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name,
423  const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc,
424  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
425 {
426  if (unlikely(FileLogFunc == NULL)) {
427  goto error;
428  }
429 
430  OutputModule *module = SCCalloc(1, sizeof(*module));
431  if (unlikely(module == NULL)) {
432  goto error;
433  }
434 
435  module->logger_id = id;
436  module->name = name;
437  module->conf_name = conf_name;
438  module->parent_name = parent_name;
439  module->InitSubFunc = InitFunc;
440  module->FileLogFunc = FileLogFunc;
441  module->ThreadInit = ThreadInit;
442  module->ThreadDeinit = ThreadDeinit;
443  TAILQ_INSERT_TAIL(&output_modules, module, entries);
444 
445  SCLogDebug("File logger \"%s\" registered.", name);
446  return;
447 error:
448  FatalError("Fatal error encountered. Exiting...");
449 }
450 
451 /**
452  * \brief Register a file data output module.
453  *
454  * This function will register an output module so it can be
455  * configured with the configuration file.
456  *
457  * \retval Returns 0 on success, -1 on failure.
458  */
459 void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name,
460  OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit,
461  ThreadDeinitFunc ThreadDeinit)
462 {
463  if (unlikely(FiledataLogFunc == NULL)) {
464  goto error;
465  }
466 
467  OutputModule *module = SCCalloc(1, sizeof(*module));
468  if (unlikely(module == NULL)) {
469  goto error;
470  }
471 
472  module->logger_id = id;
473  module->name = name;
474  module->conf_name = conf_name;
475  module->InitFunc = InitFunc;
476  module->FiledataLogFunc = FiledataLogFunc;
477  module->ThreadInit = ThreadInit;
478  module->ThreadDeinit = ThreadDeinit;
479  TAILQ_INSERT_TAIL(&output_modules, module, entries);
480 
481  SCLogDebug("Filedata logger \"%s\" registered.", name);
482  return;
483 error:
484  FatalError("Fatal error encountered. Exiting...");
485 }
486 
487 /**
488  * \brief Register a flow output sub-module.
489  *
490  * This function will register an output module so it can be
491  * configured with the configuration file.
492  *
493  * \retval Returns 0 on success, -1 on failure.
494  */
495 void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name,
496  const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc,
497  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
498 {
499  if (unlikely(FlowLogFunc == NULL)) {
500  goto error;
501  }
502 
503  OutputModule *module = SCCalloc(1, sizeof(*module));
504  if (unlikely(module == NULL)) {
505  goto error;
506  }
507 
508  module->logger_id = id;
509  module->name = name;
510  module->conf_name = conf_name;
511  module->parent_name = parent_name;
512  module->InitSubFunc = InitFunc;
513  module->FlowLogFunc = FlowLogFunc;
514  module->ThreadInit = ThreadInit;
515  module->ThreadDeinit = ThreadDeinit;
516  TAILQ_INSERT_TAIL(&output_modules, module, entries);
517 
518  SCLogDebug("Flow logger \"%s\" registered.", name);
519  return;
520 error:
521  FatalError("Fatal error encountered. Exiting...");
522 }
523 
524 /**
525  * \brief Register a streaming data output module.
526  *
527  * This function will register an output module so it can be
528  * configured with the configuration file.
529  *
530  * \retval Returns 0 on success, -1 on failure.
531  */
532 void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name,
533  OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc,
534  enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit,
535  ThreadDeinitFunc ThreadDeinit)
536 {
537  if (unlikely(StreamingLogFunc == NULL)) {
538  goto error;
539  }
540 
541  OutputModule *module = SCCalloc(1, sizeof(*module));
542  if (unlikely(module == NULL)) {
543  goto error;
544  }
545 
546  module->logger_id = id;
547  module->name = name;
548  module->conf_name = conf_name;
549  module->InitFunc = InitFunc;
550  module->StreamingLogFunc = StreamingLogFunc;
551  module->stream_type = stream_type;
552  module->ThreadInit = ThreadInit;
553  module->ThreadDeinit = ThreadDeinit;
554  TAILQ_INSERT_TAIL(&output_modules, module, entries);
555 
556  SCLogDebug("Streaming logger \"%s\" registered.", name);
557  return;
558 error:
559  FatalError("Fatal error encountered. Exiting...");
560 }
561 
562 /**
563  * \brief Register a stats data output module.
564  *
565  * This function will register an output module so it can be
566  * configured with the configuration file.
567  *
568  * \retval Returns 0 on success, -1 on failure.
569  */
570 void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name,
571  OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit,
572  ThreadDeinitFunc ThreadDeinit)
573 {
574  if (unlikely(StatsLogFunc == NULL)) {
575  goto error;
576  }
577 
578  OutputModule *module = SCCalloc(1, sizeof(*module));
579  if (unlikely(module == NULL)) {
580  goto error;
581  }
582 
583  module->logger_id = id;
584  module->name = name;
585  module->conf_name = conf_name;
586  module->InitFunc = InitFunc;
587  module->StatsLogFunc = StatsLogFunc;
588  module->ThreadInit = ThreadInit;
589  module->ThreadDeinit = ThreadDeinit;
590  TAILQ_INSERT_TAIL(&output_modules, module, entries);
591 
592  SCLogDebug("Stats logger \"%s\" registered.", name);
593  return;
594 error:
595  FatalError("Fatal error encountered. Exiting...");
596 }
597 
598 /**
599  * \brief Register a stats data output sub-module.
600  *
601  * This function will register an output module so it can be
602  * configured with the configuration file.
603  *
604  * \retval Returns 0 on success, -1 on failure.
605  */
606 void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name,
607  const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc,
608  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
609 {
610  if (unlikely(StatsLogFunc == NULL)) {
611  goto error;
612  }
613 
614  OutputModule *module = SCCalloc(1, sizeof(*module));
615  if (unlikely(module == NULL)) {
616  goto error;
617  }
618 
619  module->logger_id = id;
620  module->name = name;
621  module->conf_name = conf_name;
622  module->parent_name = parent_name;
623  module->InitSubFunc = InitFunc;
624  module->StatsLogFunc = StatsLogFunc;
625  module->ThreadInit = ThreadInit;
626  module->ThreadDeinit = ThreadDeinit;
627  TAILQ_INSERT_TAIL(&output_modules, module, entries);
628 
629  SCLogDebug("Stats logger \"%s\" registered.", name);
630  return;
631 error:
632  FatalError("Fatal error encountered. Exiting...");
633 }
634 
635 /**
636  * \brief Get an output module by name.
637  *
638  * \retval The OutputModule with the given name or NULL if no output module
639  * with the given name is registered.
640  */
642 {
643  OutputModule *module;
644 
645  TAILQ_FOREACH(module, &output_modules, entries) {
646  if (strcmp(module->conf_name, conf_name) == 0)
647  return module;
648  }
649 
650  return NULL;
651 }
652 
653 static EveJsonSimpleAppLayerLogger *simple_json_applayer_loggers;
654 
655 /**
656  * \brief Deregister all modules. Useful for a memory clean exit.
657  */
659 {
660  OutputModule *module;
661 
662  while ((module = TAILQ_FIRST(&output_modules))) {
663  TAILQ_REMOVE(&output_modules, module, entries);
664  SCFree(module);
665  }
666  SCFree(simple_json_applayer_loggers);
667  simple_json_applayer_loggers = NULL;
668 }
669 
670 static int drop_loggers = 0;
671 
673 {
674  if (drop_loggers)
675  return -1;
676  drop_loggers++;
677  return 0;
678 }
679 
681 {
682  if (drop_loggers)
683  drop_loggers--;
684 }
685 
686 /**
687  * \brief Register a flag for file rotation notification.
688  *
689  * \param flag A pointer that will be set to 1 when file rotation is
690  * requested.
691  */
693 {
694  OutputFileRolloverFlag *flag_entry = SCCalloc(1, sizeof(*flag_entry));
695  if (unlikely(flag_entry == NULL)) {
696  SCLogError("Failed to allocate memory to register file rotation flag");
697  return;
698  }
699  flag_entry->flag = flag;
700  SCMutexLock(&output_file_rotation_mutex);
701  TAILQ_INSERT_TAIL(&output_file_rotation_flags, flag_entry, entries);
702  SCMutexUnlock(&output_file_rotation_mutex);
703 }
704 
705 /**
706  * \brief Unregister a file rotation flag.
707  *
708  * Note that it is safe to call this function with a flag that may not
709  * have been registered, in which case this function won't do
710  * anything.
711  *
712  * \param flag A pointer that has been previously registered for file
713  * rotation notifications.
714  */
716 {
717  OutputFileRolloverFlag *entry, *next;
718  SCMutexLock(&output_file_rotation_mutex);
719  for (entry = TAILQ_FIRST(&output_file_rotation_flags); entry != NULL;
720  entry = next) {
721  next = TAILQ_NEXT(entry, entries);
722  if (entry->flag == flag) {
723  TAILQ_REMOVE(&output_file_rotation_flags, entry, entries);
724  SCMutexUnlock(&output_file_rotation_mutex);
725  SCFree(entry);
726  return;
727  }
728  }
729  SCMutexUnlock(&output_file_rotation_mutex);
730 }
731 
732 /**
733  * \brief Notifies all registered file rotation notification flags.
734  */
736  OutputFileRolloverFlag *flag = NULL;
737  OutputFileRolloverFlag *tflag;
738  SCMutexLock(&output_file_rotation_mutex);
739  TAILQ_FOREACH_SAFE (flag, &output_file_rotation_flags, entries, tflag) {
740  *(flag->flag) = 1;
741  }
742  SCMutexUnlock(&output_file_rotation_mutex);
743 }
744 
745 /**
746  * \brief Register a callback to be called when logging is ready.
747  *
748  * This function registers a callback that will be invoked when the logging
749  * system has been fully initialized. This is useful for both plugins and
750  * library users who need to register application transaction loggers after
751  * logging initialization is complete.
752  *
753  * \param callback The callback function to be called
754  * \param arg An argument to be passed to the callback function
755  * \return 0 on success, -1 on failure
756  */
758 {
759  OnLoggingReadyCallbackNode *node = SCCalloc(1, sizeof(*node));
760  if (node == NULL) {
761  SCLogError("Failed to allocate memory for callback node");
762  return -1;
763  }
764 
765  node->callback = callback;
766  node->arg = arg;
767  TAILQ_INSERT_TAIL(&on_logging_ready_callbacks, node, entries);
768 
769  return 0;
770 }
771 
772 /**
773  * \brief Invokes all registered logging ready callbacks.
774  *
775  * This function should be called after the logging system has been fully
776  * initialized to notify all registered callbacks that logging is ready.
777  */
779 {
780  OnLoggingReadyCallbackNode *node = NULL;
781  TAILQ_FOREACH (node, &on_logging_ready_callbacks, entries) {
782  if (node->callback) {
783  (*node->callback)(node->arg);
784  }
785  }
786 }
787 
788 TmEcode OutputLoggerFlush(ThreadVars *tv, Packet *p, void *thread_data)
789 {
790  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
791  RootLogger *logger = TAILQ_FIRST(&active_loggers);
792  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
793  while (logger && thread_store_node) {
794  if (logger->FlushFunc)
795  logger->FlushFunc(tv, p, thread_store_node->thread_data);
796 
797  logger = TAILQ_NEXT(logger, entries);
798  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
799  }
800  return TM_ECODE_OK;
801 }
802 
803 TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
804 {
805  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
806  RootLogger *logger = TAILQ_FIRST(&active_loggers);
807  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
808  while (logger && thread_store_node) {
809  logger->LogFunc(tv, p, thread_store_node->thread_data);
810 
811  logger = TAILQ_NEXT(logger, entries);
812  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
813  }
814  return TM_ECODE_OK;
815 }
816 
817 TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
818 {
819  LoggerThreadStore *thread_store = SCCalloc(1, sizeof(*thread_store));
820  if (thread_store == NULL) {
821  return TM_ECODE_FAILED;
822  }
823  TAILQ_INIT(thread_store);
824  *data = (void *)thread_store;
825 
826  RootLogger *logger;
827  TAILQ_FOREACH(logger, &active_loggers, entries) {
828 
829  void *child_thread_data = NULL;
830  if (logger->ThreadInit != NULL) {
831  if (logger->ThreadInit(tv, initdata, &child_thread_data) == TM_ECODE_OK) {
832  LoggerThreadStoreNode *thread_store_node =
833  SCCalloc(1, sizeof(*thread_store_node));
834  if (thread_store_node == NULL) {
835  /* Undo everything, calling de-init will take care
836  * of that. */
837  OutputLoggerThreadDeinit(tv, thread_store);
838  return TM_ECODE_FAILED;
839  }
840  thread_store_node->thread_data = child_thread_data;
841  TAILQ_INSERT_TAIL(thread_store, thread_store_node, entries);
842  }
843  }
844  }
845  return TM_ECODE_OK;
846 }
847 
849 {
850  if (thread_data == NULL)
851  return TM_ECODE_FAILED;
852 
853  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
854  RootLogger *logger = TAILQ_FIRST(&active_loggers);
855  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
856  while (logger && thread_store_node) {
857  if (logger->ThreadDeinit != NULL) {
858  logger->ThreadDeinit(tv, thread_store_node->thread_data);
859  }
860  logger = TAILQ_NEXT(logger, entries);
861  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
862  }
863 
864  /* Free the thread store. */
865  while ((thread_store_node = TAILQ_FIRST(thread_store)) != NULL) {
866  TAILQ_REMOVE(thread_store, thread_store_node, entries);
867  SCFree(thread_store_node);
868  }
869  SCFree(thread_store);
870 
871  return TM_ECODE_OK;
872 }
873 
875  OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
876 {
877  BUG_ON(LogFunc == NULL);
878 
879  RootLogger *logger = SCCalloc(1, sizeof(*logger));
880  if (logger == NULL) {
881  FatalError("failed to alloc root logger");
882  }
883  logger->ThreadInit = ThreadInit;
884  logger->ThreadDeinit = ThreadDeinit;
885  logger->LogFunc = LogFunc;
886  logger->ActiveCntFunc = ActiveCntFunc;
887  TAILQ_INSERT_TAIL(&registered_loggers, logger, entries);
888 }
889 
890 static void OutputRegisterActiveLogger(RootLogger *reg)
891 {
892  RootLogger *logger = SCCalloc(1, sizeof(*logger));
893  if (logger == NULL) {
894  FatalError("failed to alloc root logger");
895  }
896  logger->ThreadInit = reg->ThreadInit;
897  logger->ThreadDeinit = reg->ThreadDeinit;
898  logger->LogFunc = reg->LogFunc;
899  logger->ActiveCntFunc = reg->ActiveCntFunc;
900  TAILQ_INSERT_TAIL(&active_loggers, logger, entries);
901 }
902 
904 {
905  RootLogger *logger = TAILQ_FIRST(&registered_loggers);
906  while (logger) {
907  uint32_t cnt = logger->ActiveCntFunc();
908  if (cnt) {
909  OutputRegisterActiveLogger(logger);
910  }
911 
912  logger = TAILQ_NEXT(logger, entries);
913  }
914 }
915 
917 {
918  RootLogger *logger;
919  while ((logger = TAILQ_FIRST(&active_loggers)) != NULL) {
920  TAILQ_REMOVE(&active_loggers, logger, entries);
921  SCFree(logger);
922  }
923 }
924 
926 {
929 }
930 
932 {
933  if (alproto < g_alproto_max) {
934  return &simple_json_applayer_loggers[alproto];
935  }
936  return NULL;
937 }
938 
939 static void RegisterSimpleJsonApplayerLogger(
940  AppProto alproto, EveJsonSimpleTxLogFunc LogTx, const char *name)
941 {
942  simple_json_applayer_loggers[alproto].LogTx = LogTx;
943  if (name) {
944  simple_json_applayer_loggers[alproto].name = name;
945  } else {
946  simple_json_applayer_loggers[alproto].name = AppProtoToString(alproto);
947  }
948 }
949 
950 /**
951  * \brief Register all root loggers.
952  */
954 {
955  simple_json_applayer_loggers = SCCalloc(g_alproto_max, sizeof(EveJsonSimpleAppLayerLogger));
956  if (unlikely(simple_json_applayer_loggers == NULL)) {
957  FatalError("Failed to allocate simple_json_applayer_loggers");
958  }
959  // ALPROTO_HTTP1 special: uses some options flags
960  RegisterSimpleJsonApplayerLogger(ALPROTO_FTP, (EveJsonSimpleTxLogFunc)EveFTPLogCommand, NULL);
961  // ALPROTO_SMTP special: uses state
962  RegisterSimpleJsonApplayerLogger(
964  // no cast here but done in rust for SSHTransaction
965  RegisterSimpleJsonApplayerLogger(ALPROTO_SSH, (EveJsonSimpleTxLogFunc)SCSshLogJson, NULL);
966  // ALPROTO_SMB special: uses state
967  // ALPROTO_DCERPC special: uses state
968  RegisterSimpleJsonApplayerLogger(ALPROTO_DNS, (EveJsonSimpleTxLogFunc)AlertJsonDns, NULL);
969  RegisterSimpleJsonApplayerLogger(ALPROTO_MDNS, (EveJsonSimpleTxLogFunc)AlertJsonMdns, NULL);
970  // either need a cast here or in rust for ModbusTransaction, done here
971  RegisterSimpleJsonApplayerLogger(ALPROTO_MODBUS, (EveJsonSimpleTxLogFunc)SCModbusToJson, NULL);
972  RegisterSimpleJsonApplayerLogger(ALPROTO_ENIP, (EveJsonSimpleTxLogFunc)SCEnipLoggerLog, NULL);
973  RegisterSimpleJsonApplayerLogger(ALPROTO_DNP3, (EveJsonSimpleTxLogFunc)AlertJsonDnp3, NULL);
974  // ALPROTO_NFS special: uses state
975  // underscore instead of dash for ftp_data
976  RegisterSimpleJsonApplayerLogger(
978  RegisterSimpleJsonApplayerLogger(
979  ALPROTO_TFTP, (EveJsonSimpleTxLogFunc)SCTftpLogJsonRequest, NULL);
980  // ALPROTO_IKE special: uses state
981  RegisterSimpleJsonApplayerLogger(
982  ALPROTO_KRB5, (EveJsonSimpleTxLogFunc)SCKrb5LogJsonResponse, NULL);
983  RegisterSimpleJsonApplayerLogger(ALPROTO_QUIC, (EveJsonSimpleTxLogFunc)SCQuicLogJson, NULL);
984  // ALPROTO_DHCP TODO missing
985  RegisterSimpleJsonApplayerLogger(ALPROTO_SIP, (EveJsonSimpleTxLogFunc)SCSipLogJson, NULL);
986  RegisterSimpleJsonApplayerLogger(ALPROTO_RFB, (EveJsonSimpleTxLogFunc)SCRfbJsonLogger, NULL);
987  RegisterSimpleJsonApplayerLogger(ALPROTO_POP3, (EveJsonSimpleTxLogFunc)SCPop3LoggerLog, NULL);
988  RegisterSimpleJsonApplayerLogger(
990  RegisterSimpleJsonApplayerLogger(
992  RegisterSimpleJsonApplayerLogger(
993  ALPROTO_WEBSOCKET, (EveJsonSimpleTxLogFunc)SCWebSocketLoggerLog, NULL);
994  RegisterSimpleJsonApplayerLogger(ALPROTO_LDAP, (EveJsonSimpleTxLogFunc)SCLdapLoggerLog, NULL);
995  RegisterSimpleJsonApplayerLogger(ALPROTO_DOH2, (EveJsonSimpleTxLogFunc)AlertJsonDoh2, NULL);
996  RegisterSimpleJsonApplayerLogger(
997  ALPROTO_TEMPLATE, (EveJsonSimpleTxLogFunc)SCTemplateLoggerLog, NULL);
998  RegisterSimpleJsonApplayerLogger(ALPROTO_RDP, (EveJsonSimpleTxLogFunc)SCRdpToJson, NULL);
999  // special case : http2 is logged in http object
1000  RegisterSimpleJsonApplayerLogger(ALPROTO_HTTP2, (EveJsonSimpleTxLogFunc)SCHttp2LogJson, "http");
1001  // underscore instead of dash for bittorrent_dht
1002  RegisterSimpleJsonApplayerLogger(ALPROTO_BITTORRENT_DHT,
1003  (EveJsonSimpleTxLogFunc)SCBittorrentDhtLogger, "bittorrent_dht");
1004 
1010 }
1011 
1012 static int JsonGenericLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
1013  void *state, void *tx, uint64_t tx_id, int dir)
1014 {
1015  OutputJsonThreadCtx *thread = thread_data;
1017  if (al == NULL) {
1018  return TM_ECODE_FAILED;
1019  }
1020 
1021  SCJsonBuilder *js = CreateEveHeader(p, dir, al->name, NULL, thread->ctx);
1022  if (unlikely(js == NULL)) {
1023  return TM_ECODE_FAILED;
1024  }
1025 
1026  if (!al->LogTx(tx, js)) {
1027  goto error;
1028  }
1029 
1030  OutputJsonBuilderBuffer(tv, p, p->flow, js, thread);
1031  SCJbFree(js);
1032 
1033  return TM_ECODE_OK;
1034 
1035 error:
1036  SCJbFree(js);
1037  return TM_ECODE_FAILED;
1038 }
1039 
1040 static int JsonGenericDirPacketLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
1041  void *state, void *tx, uint64_t tx_id)
1042 {
1043  return JsonGenericLogger(tv, thread_data, p, f, state, tx, tx_id, LOG_DIR_PACKET);
1044 }
1045 
1046 static int JsonGenericDirFlowLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
1047  void *state, void *tx, uint64_t tx_id)
1048 {
1049  return JsonGenericLogger(tv, thread_data, p, f, state, tx, tx_id, LOG_DIR_FLOW);
1050 }
1051 
1052 #define ARRAY_CAP_STEP 16
1053 static EveJsonTxLoggerRegistrationData *preregistered_loggers = NULL;
1054 static size_t preregistered_loggers_nb = 0;
1055 static size_t preregistered_loggers_cap = 0;
1056 
1057 // Plugins can preregister logger with this function :
1058 // When an app-layer plugin is loaded, it wants to register its logger
1059 // But the plugin is loaded before loggers can register
1060 // The preregistration data will later be used by OutputRegisterLoggers
1062 {
1063  if (preregistered_loggers_nb == preregistered_loggers_cap) {
1064  void *tmp = SCRealloc(
1065  preregistered_loggers, sizeof(EveJsonTxLoggerRegistrationData) *
1066  (preregistered_loggers_cap + ARRAY_CAP_STEP));
1067  if (tmp == NULL) {
1068  return 1;
1069  }
1070  preregistered_loggers_cap += ARRAY_CAP_STEP;
1071  preregistered_loggers = tmp;
1072  }
1073  preregistered_loggers[preregistered_loggers_nb] = reg_data;
1074  preregistered_loggers_nb++;
1075  return 0;
1076 }
1077 
1078 static TxLogger JsonLoggerFromDir(uint8_t dir)
1079 {
1080  if (dir == LOG_DIR_PACKET) {
1081  return JsonGenericDirPacketLogger;
1082  }
1083  BUG_ON(dir != LOG_DIR_FLOW);
1084  return JsonGenericDirFlowLogger;
1085 }
1086 
1087 /**
1088  * \brief Register all non-root logging modules.
1089  */
1091 {
1092  /* custom format log*/
1094 
1095  LuaLogRegister();
1096  /* fast log */
1098  /* debug log */
1100  /* syslog log */
1104  /* json log */
1106  /* email logs */
1108  /* http log */
1111  OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "LogHttp2Log", "eve-log.http2",
1112  OutputJsonLogInitSub, ALPROTO_HTTP2, JsonGenericDirFlowLogger, HTTP2StateClosed,
1113  HTTP2StateClosed, JsonLogThreadInit, JsonLogThreadDeinit);
1114  /* tls log */
1118  /* ssh */
1119  OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_TX, "eve-log", "JsonSshLog", "eve-log.ssh",
1120  OutputJsonLogInitSub, ALPROTO_SSH, JsonGenericDirFlowLogger, SSHTxLogCondition,
1122  /* pcap log */
1123  PcapLogRegister();
1124  /* file log */
1127  /* dns */
1129  /* mdns */
1131  /* modbus */
1132  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonModbusLog", "eve-log.modbus",
1133  OutputJsonLogInitSub, ALPROTO_MODBUS, JsonGenericDirFlowLogger, JsonLogThreadInit,
1135 
1136  SCLogDebug("modbus json logger registered.");
1137  /* tcp streaming data */
1139  /* log stats */
1141 
1144  /* flow/netflow */
1147  /* json stats */
1149 
1150  /* DNP3. */
1153 
1154  /* NFS JSON logger. */
1156  /* TFTP JSON logger. */
1157  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTFTPLog", "eve-log.tftp",
1158  OutputJsonLogInitSub, ALPROTO_TFTP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1160 
1161  SCLogDebug("TFTP JSON logger registered.");
1162  /* FTP and FTP-DATA JSON loggers. */
1163  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
1164  OutputJsonLogInitSub, ALPROTO_FTP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1166  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
1167  OutputJsonLogInitSub, ALPROTO_FTPDATA, JsonGenericDirFlowLogger, JsonLogThreadInit,
1169  SCLogDebug("FTP JSON logger registered.");
1170 
1171  /* SMB JSON logger. */
1173  /* IKE JSON logger. */
1175  /* KRB5 JSON logger. */
1176  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonKRB5Log", "eve-log.krb5",
1177  OutputJsonLogInitSub, ALPROTO_KRB5, JsonGenericDirPacketLogger, JsonLogThreadInit,
1179 
1180  SCLogDebug("KRB5 JSON logger registered.");
1181  /* QUIC JSON logger. */
1182  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonQuicLog", "eve-log.quic",
1183  OutputJsonLogInitSub, ALPROTO_QUIC, JsonGenericDirPacketLogger, JsonLogThreadInit,
1185 
1186  SCLogDebug("quic json logger registered.");
1187  /* DHCP JSON logger. */
1189 
1190  /* SIP JSON logger. */
1191  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSIPLog", "eve-log.sip",
1192  OutputJsonLogInitSub, ALPROTO_SIP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1194 
1195  SCLogDebug("SIP JSON logger registered.");
1196  /* RFB JSON logger. */
1197  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRFBLog", "eve-log.rfb",
1198  OutputJsonLogInitSub, ALPROTO_RFB, JsonGenericDirPacketLogger, JsonLogThreadInit,
1200  /* MQTT JSON logger. */
1202  /* Pgsql JSON logger. */
1204  /* WebSocket JSON logger. */
1205  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonWebSocketLog", "eve-log.websocket",
1206  OutputJsonLogInitSub, ALPROTO_WEBSOCKET, JsonGenericDirPacketLogger, JsonLogThreadInit,
1208  /* Enip JSON logger. */
1209  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonEnipLog", "eve-log.enip",
1210  OutputJsonLogInitSub, ALPROTO_ENIP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1212  /* Ldap JSON logger. */
1213  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonLdapLog", "eve-log.ldap",
1214  OutputJsonLogInitSub, ALPROTO_LDAP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1216  /* DoH2 JSON logger. */
1218  /* POP3 JSON logger */
1219  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonPop3Log", "eve-log.pop3",
1220  OutputJsonLogInitSub, ALPROTO_POP3, JsonGenericDirFlowLogger, JsonLogThreadInit,
1222  /* Mdns JSON logger. */
1223  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonMdnsLog", "eve-log.template",
1224  OutputJsonLogInitSub, ALPROTO_MDNS, JsonGenericDirPacketLogger, JsonLogThreadInit,
1226  /* Template JSON logger. */
1227  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTemplateLog", "eve-log.template",
1228  OutputJsonLogInitSub, ALPROTO_TEMPLATE, JsonGenericDirPacketLogger, JsonLogThreadInit,
1230  /* RDP JSON logger. */
1231  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRdpLog", "eve-log.rdp",
1232  OutputJsonLogInitSub, ALPROTO_RDP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1234  SCLogDebug("rdp json logger registered.");
1235  /* DCERPC JSON logger. */
1237  /* app layer frames */
1239  /* BitTorrent DHT JSON logger */
1240  if (SCConfGetNode("app-layer.protocols.bittorrent-dht") != NULL) {
1241  /* Register as an eve sub-module. */
1242  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonBitTorrentDHTLog",
1243  "eve-log.bittorrent-dht", OutputJsonLogInitSub, ALPROTO_BITTORRENT_DHT,
1244  JsonGenericDirPacketLogger, JsonLogThreadInit, JsonLogThreadDeinit);
1245  }
1246  /* ARP JSON logger */
1248 
1249  for (size_t i = 0; i < preregistered_loggers_nb; i++) {
1250  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", preregistered_loggers[i].logname,
1251  preregistered_loggers[i].confname, OutputJsonLogInitSub,
1252  preregistered_loggers[i].alproto, JsonLoggerFromDir(preregistered_loggers[i].dir),
1254  SCLogDebug(
1255  "%s JSON logger registered.", AppProtoToString(preregistered_loggers[i].alproto));
1256  RegisterSimpleJsonApplayerLogger(preregistered_loggers[i].alproto,
1257  (EveJsonSimpleTxLogFunc)preregistered_loggers[i].LogTx, NULL);
1258  }
1259 }
RootLogger_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.c:92
log-stats.h
JsonMQTTAddMetadata
bool JsonMQTTAddMetadata(void *vtx, SCJsonBuilder *js)
Definition: output-json-mqtt.c:63
OutputModule_::parent_name
const char * parent_name
Definition: output.h:61
OutputFileRolloverFlag
OutputFileRolloverFlag
Definition: output.c:128
LogTlsStoreRegister
void LogTlsStoreRegister(void)
Definition: log-tlsstore.c:437
tm-threads.h
OutputModule_::FileLogFunc
SCFileLogger FileLogFunc
Definition: output.h:73
output-json-ftp.h
OutputDropLoggerEnable
int OutputDropLoggerEnable(void)
Definition: output.c:672
OutputRegisterStreamingModule
void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc, enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming data output module.
Definition: output.c:532
LoggerThreadStoreNode
LoggerThreadStoreNode
Definition: output.c:112
OutputLogFunc
TmEcode(* OutputLogFunc)(ThreadVars *, Packet *, void *)
Definition: output.h:53
JsonDoh2LogRegister
void JsonDoh2LogRegister(void)
Definition: output-json-dns.c:693
app-layer-ssh.h
JsonDCERPCLogRegister
void JsonDCERPCLogRegister(void)
Definition: output-json-dcerpc.c:67
OutputTxLoggerRegister
void OutputTxLoggerRegister(void)
Definition: output-tx.c:649
alert-debuglog.h
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
JsonPgsqlLogRegister
void JsonPgsqlLogRegister(void)
Definition: output-json-pgsql.c:184
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
OutputJsonThreadCtx_::ctx
OutputJsonCtx * ctx
Definition: output-json.h:84
JsonTlsLogJSONExtended
bool JsonTlsLogJSONExtended(void *vtx, SCJsonBuilder *tjs)
Definition: output-json-tls.c:498
OutputModule_::PacketFlushFunc
PacketLogger PacketFlushFunc
Definition: output.h:69
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:49
OutputRegisterTxSubModuleWithProgress
void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:381
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb)
Definition: app-layer-ftp.c:1382
JsonSMBLogRegister
void JsonSMBLogRegister(void)
Definition: output-json-smb.c:151
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
OutputRegisterRootLogger
void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
Definition: output.c:874
output-json-mqtt.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:275
output-eve-stream.h
OutputFileLoggerRegister
void OutputFileLoggerRegister(void)
Definition: output-file.c:235
RootLogger_::FlushFunc
OutputFlushFunc FlushFunc
Definition: output.c:90
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
OutputPacketLoggerFunctions_::FlushFunc
PacketLogger FlushFunc
Definition: output.h:89
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:48
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:86
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:57
SCFileLogger
int(* SCFileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, void *tx, const uint64_t tx_id, uint8_t direction)
Definition: output-file.h:48
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:71
SCEveJsonSimpleGetLogger
EveJsonSimpleAppLayerLogger * SCEveJsonSimpleGetLogger(AppProto alproto)
Definition: output.c:931
CreateEveHeader
SCJsonBuilder * CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Definition: output-json.c:850
JsonLogThreadInit
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
Definition: output-json-common.c:99
OutputModule_::name
const char * name
Definition: output.h:59
Flow_
Flow data structure.
Definition: flow.h:356
LogTlsLogRegister
void LogTlsLogRegister(void)
Definition: log-tlslog.c:499
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:58
LoggerId
LoggerId
Definition: suricata-common.h:477
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
AlertFastLogRegister
void AlertFastLogRegister(void)
Definition: alert-fastlog.c:77
output-json-pgsql.h
JsonFileLogRegister
void JsonFileLogRegister(void)
Definition: output-json-file.c:352
AlertJsonDns
bool AlertJsonDns(void *txptr, SCJsonBuilder *js)
Definition: output-json-dns.c:252
output-json-frame.h
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:81
OutputRegisterStatsSubModule
void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a stats data output sub-module.
Definition: output.c:606
output-json-netflow.h
JsonDNP3LogRegister
void JsonDNP3LogRegister(void)
Definition: output-json-dnp3.c:366
LogCustomFormatRegister
void LogCustomFormatRegister(void)
Definition: log-cf-common.c:271
SCOutputEvePreRegisterLogger
int SCOutputEvePreRegisterLogger(EveJsonTxLoggerRegistrationData reg_data)
Definition: output.c:1061
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
output-json-arp.h
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:641
output-json-tls.h
OutputInitFunc
OutputInitResult(* OutputInitFunc)(SCConfNode *)
Definition: output.h:51
SSHTxLogCondition
bool SSHTxLogCondition(ThreadVars *tv, const Packet *p, void *state, void *tx, uint64_t tx_id)
Definition: app-layer-ssh.c:74
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:59
OutputRegisterTxSubModule
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:406
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:903
AlertSyslogRegister
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
Definition: alert-syslog.c:384
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:77
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition: app-layer-protos.h:65
JsonDHCPLogRegister
void JsonDHCPLogRegister(void)
Definition: output-json-dhcp.c:145
TxLogger
int(* TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
Transaction logger function pointer type.
Definition: output-tx.h:34
FlowLogger
int(* FlowLogger)(ThreadVars *, void *thread_data, Flow *f)
Flow logger function pointer type.
Definition: output-flow.h:36
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
OutputJsonBuilderBuffer
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:1015
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
PcapLogRegister
void PcapLogRegister(void)
Definition: log-pcap.c:219
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:63
OutputRegisterFiledataModule
void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file data output module.
Definition: output.c:459
SCFiledataLogger
int(* SCFiledataLogger)(ThreadVars *, void *thread_data, const Packet *, File *, void *tx, const uint64_t tx_id, const uint8_t *, uint32_t, uint8_t, uint8_t dir)
File-data logger function pointer type.
Definition: output-filedata.h:51
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:40
app-layer-ftp.h
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:68
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
OutputModule_::FiledataLogFunc
SCFiledataLogger FiledataLogFunc
Definition: output.h:74
JsonStatsLogRegister
void JsonStatsLogRegister(void)
Definition: output-json-stats.c:501
LogTcpDataLogRegister
void LogTcpDataLogRegister(void)
Definition: log-tcp-data.c:46
SCOnLoggingReadyCallback
void(* SCOnLoggingReadyCallback)(void *arg)
Definition: output.h:162
OutputRegisterRootLoggers
void OutputRegisterRootLoggers(void)
Register all root loggers.
Definition: output.c:953
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output.c:848
OutputRegisterTxModule
void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module.
Definition: output.c:398
OutputModule_::alproto
AppProto alproto
Definition: output.h:78
JsonTlsLogRegister
void JsonTlsLogRegister(void)
Definition: output-json-tls.c:707
OutputRegisterFileSubModule
void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file output sub-module.
Definition: output.c:422
alert-syslog.h
JsonFlowLogRegister
void JsonFlowLogRegister(void)
Definition: output-json-flow.c:440
SCRegisterOnLoggingReady
int SCRegisterOnLoggingReady(SCOnLoggingReadyCallback callback, void *arg)
Register a callback to be called when logging is ready.
Definition: output.c:757
OutputPacketLoggerFunctions_::ConditionFunc
PacketLogCondition ConditionFunc
Definition: output.h:90
TmModuleLoggerRegister
void TmModuleLoggerRegister(void)
Definition: output.c:925
output-json-dcerpc.h
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
JsonPgsqlAddMetadata
bool JsonPgsqlAddMetadata(void *vtx, SCJsonBuilder *jb)
Definition: output-json-pgsql.c:62
OutputJsonRegister
void OutputJsonRegister(void)
Definition: output-json.c:83
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:916
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:56
OutputJsonThreadCtx_
Definition: output-json.h:83
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
RootLogger_::LogFunc
OutputLogFunc LogFunc
Definition: output.c:89
output-json-dnp3.h
OutputRegisterFileRotationFlag
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:692
OutputJsonLogInitSub
OutputInitResult OutputJsonLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
Definition: output-json-common.c:82
LogHttpLogRegister
void LogHttpLogRegister(void)
Definition: log-httplog.c:65
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
Definition: output.c:495
OutputModule_::stream_type
enum SCOutputStreamingType stream_type
Definition: output.h:79
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:65
OutputRegisterTxModuleWithCondition
void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module with condition.
Definition: output.c:349
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
output_modules
OutputModuleList output_modules
JsonAnomalyLogRegister
void JsonAnomalyLogRegister(void)
Definition: output-json-anomaly.c:456
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
util-debug.h
output-json-flow.h
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
OutputStreamingLoggerRegister
void OutputStreamingLoggerRegister(void)
Definition: output-streaming.c:432
util-error.h
OutputRegisterStatsModule
void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a stats data output module.
Definition: output.c:570
log-tcp-data.h
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:66
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:50
output-json.h
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
OutputRegisterTxModuleWithProgress
void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module with progress.
Definition: output.c:373
output-json-file.h
OutputRegisterModule
void OutputRegisterModule(const char *, const char *, OutputInitFunc)
JsonIKELogRegister
void JsonIKELogRegister(void)
Definition: output-json-ike.c:182
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
JsonMdnsLogRegister
void JsonMdnsLogRegister(void)
Definition: output-json-mdns.c:155
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:43
OutputModule_::StreamingLogFunc
SCStreamingLogger StreamingLogFunc
Definition: output.h:76
log-tlslog.h
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
Definition: output.c:817
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-eve-bindgen.h:33
app-layer-parser.h
JsonMQTTLogRegister
void JsonMQTTLogRegister(void)
Definition: output-json-mqtt.c:192
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
OutputFilestoreRegister
void OutputFilestoreRegister(void)
Definition: output-filestore.c:503
OutputFlushFunc
TmEcode(* OutputFlushFunc)(ThreadVars *, Packet *, void *)
Definition: output.h:54
OutputRegisterLoggers
void OutputRegisterLoggers(void)
Register all non-root logging modules.
Definition: output.c:1090
OutputModule_::conf_name
const char * conf_name
Definition: output.h:60
output-json-anomaly.h
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:75
OutputDeregisterAll
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
Definition: output.c:658
Packet_
Definition: decode.h:501
RootLogger_::ActiveCntFunc
OutputGetActiveCountFunc ActiveCntFunc
Definition: output.c:93
OutputPacketLoggerRegister
void OutputPacketLoggerRegister(void)
Definition: output-packet.c:194
EveJsonTxLoggerRegistrationData
Definition: output-eve-bindgen.h:47
output-eve-bindgen.h
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:68
conf.h
OutputNotifyFileRotation
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
Definition: output.c:735
TAILQ_HEAD
typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_)
Definition: output.c:114
TmEcode
TmEcode
Definition: tm-threads-common.h:80
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
name
const char * name
Definition: tm-threads.c:2163
EveStreamLogRegister
void EveStreamLogRegister(void)
Definition: output-eve-stream.c:453
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:54
RootLogger_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.c:91
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
EveJsonSimpleAppLayerLogger
Definition: output-eve-bindgen.h:40
TAILQ_FOREACH_SAFE
#define TAILQ_FOREACH_SAFE(var, head, field, tvar)
Definition: queue.h:329
log-pcap.h
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
alert-fastlog.h
TxLoggerCondition
bool(* TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id)
Transaction logger condition function pointer type.
Definition: output-tx.h:41
LogStatsLogRegister
void LogStatsLogRegister(void)
Definition: log-stats.c:285
OutputPacketLoggerFunctions_::ThreadDeinitFunc
ThreadDeinitFunc ThreadDeinitFunc
Definition: output.h:92
JsonFrameLogRegister
void JsonFrameLogRegister(void)
Definition: output-json-frame.c:565
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:72
suricata-common.h
output-json-stats.h
EveJsonSimpleAppLayerLogger::LogTx
EveJsonSimpleTxLogFunc LogTx
Definition: output-eve-bindgen.h:41
ARRAY_CAP_STEP
#define ARRAY_CAP_STEP
Definition: output.c:1052
output-json-nfs.h
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:62
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
OutputPacketLoggerFunctions_::LogFunc
PacketLogger LogFunc
Definition: output.h:88
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, OutputPacketLoggerFunctions *output_module_functions)
Register a packet output module.
Definition: output.c:196
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:53
output-filestore.h
output-json-mdns.h
FatalError
#define FatalError(...)
Definition: util-debug.h:510
LuaLogRegister
void LuaLogRegister(void)
Definition: output-lua.c:927
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition: app-layer-protos.h:64
OutputRegisterPacketSubModule
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, OutputPacketLoggerFunctions *output_logger_functions)
Register a packet output sub-module.
Definition: output.c:234
JsonSmtpLogRegister
void JsonSmtpLogRegister(void)
Definition: output-json-smtp.c:192
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
log-httplog.h
JsonMetadataLogRegister
void JsonMetadataLogRegister(void)
Definition: output-json-metadata.c:95
output-json-alert.h
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:70
RootLogger
struct RootLogger_ RootLogger
output-json-dns.h
OutputGetActiveCountFunc
uint32_t(* OutputGetActiveCountFunc)(void)
Definition: output.h:55
OutputPacketLoggerFunctions_::ThreadInitFunc
ThreadInitFunc ThreadInitFunc
Definition: output.h:91
log-cf-common.h
output-json-metadata.h
LOGGER_JSON_TX
@ LOGGER_JSON_TX
Definition: suricata-common.h:485
EveJsonSimpleAppLayerLogger::name
const char * name
Definition: output-eve-bindgen.h:42
JsonDnsLogRegister
void JsonDnsLogRegister(void)
Definition: output-json-dns.c:686
EveFTPLogCommand
bool EveFTPLogCommand(void *vtx, SCJsonBuilder *jb)
Definition: output-json-ftp.c:49
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:181
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:267
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:803
SCFree
#define SCFree(p)
Definition: util-mem.h:61
output-json-dhcp.h
OutputLoggerFlush
TmEcode OutputLoggerFlush(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:788
ALPROTO_MDNS
@ ALPROTO_MDNS
Definition: app-layer-protos.h:72
JsonDropLogRegister
void JsonDropLogRegister(void)
Definition: output-json-drop.c:391
output-json-ike.h
StatsLogger
int(* StatsLogger)(ThreadVars *, void *thread_data, const StatsTable *)
Definition: output-stats.h:50
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:71
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:61
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:80
OnLoggingReadyCallbackNode
OnLoggingReadyCallbackNode
Definition: output.c:149
AlertJsonDnp3
bool AlertJsonDnp3(void *vtx, SCJsonBuilder *js)
Definition: output-json-dnp3.c:213
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:67
output-lua.h
SCOnLoggingReady
void SCOnLoggingReady(void)
Invokes all registered logging ready callbacks.
Definition: output.c:778
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:60
LOG_DIR_PACKET
@ LOG_DIR_PACKET
Definition: output-eve-bindgen.h:32
JsonHttpLogRegister
void JsonHttpLogRegister(void)
Definition: output-json-http.c:644
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:70
output-json-smb.h
JsonArpLogRegister
void JsonArpLogRegister(void)
Definition: output-json-arp.c:104
id
uint32_t id
Definition: detect-flowbits.c:938
SCOutputStreamingType
SCOutputStreamingType
Definition: output-streaming.h:35
AlertJsonMdns
bool AlertJsonMdns(void *txptr, SCJsonBuilder *js)
Definition: output-json-mdns.c:42
output-json-smtp.h
JsonLogThreadDeinit
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
Definition: output-json-common.c:132
output-json-http.h
flow.h
OutputModule_
Definition: output.h:57
AlertDebugLogRegister
void AlertDebugLogRegister(void)
Definition: alert-debuglog.c:481
OutputUnregisterFileRotationFlag
void OutputUnregisterFileRotationFlag(int *flag)
Unregister a file rotation flag.
Definition: output.c:715
OutputRegisterTxSubModuleWithCondition
void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:357
log-tlsstore.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
EveJsonSimpleTxLogFunc
bool(* EveJsonSimpleTxLogFunc)(const void *, void *)
Definition: output-eve-bindgen.h:38
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
OutputFiledataLoggerRegister
void OutputFiledataLoggerRegister(void)
Definition: output-filedata.c:269
AlertJsonDoh2
bool AlertJsonDoh2(void *txptr, SCJsonBuilder *js)
Definition: output-json-dns.c:258
OutputPacketLoggerFunctions_
Definition: output.h:87
SCMutex
#define SCMutex
Definition: threads-debug.h:114
OutputInitSubFunc
OutputInitResult(* OutputInitSubFunc)(SCConfNode *, OutputCtx *)
Definition: output.h:52
SCStreamingLogger
int(* SCStreamingLogger)(ThreadVars *, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags)
Definition: output-streaming.h:41
output.h
JsonAlertLogRegister
void JsonAlertLogRegister(void)
Definition: output-json-alert.c:1112
JsonNFSLogRegister
void JsonNFSLogRegister(void)
Definition: output-json-nfs.c:109
OutputDropLoggerDisable
void OutputDropLoggerDisable(void)
Definition: output.c:680
JsonNetFlowLogRegister
void JsonNetFlowLogRegister(void)
Definition: output-json-netflow.c:308
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:44
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:62
RootLogger_
Definition: output.c:88
output-json-drop.h