suricata
output.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author OISF, Jason Ish <jason.ish@oisf.net>
22  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
23  *
24  * The root logging output for all non-application logging.
25  *
26  * The loggers are made up of a hierarchy of loggers. At the top we
27  * have the root logger which is the main entry point to
28  * logging. Under the root there exists parent loggers that are the
29  * entry point for specific types of loggers such as packet logger,
30  * transaction loggers, etc. Each parent logger may have 0 or more
31  * loggers that actual handle the job of producing output to something
32  * like a file.
33  */
34 
35 #include "suricata-common.h"
36 #include "flow.h"
37 #include "conf.h"
38 #include "tm-threads.h"
39 #include "util-error.h"
40 #include "util-debug.h"
41 #include "output.h"
42 #include "output-eve-bindgen.h"
43 
44 #include "alert-fastlog.h"
45 #include "alert-debuglog.h"
46 #include "alert-syslog.h"
47 #include "output-json.h"
48 #include "output-json-alert.h"
49 #include "output-json-anomaly.h"
50 #include "output-json-flow.h"
51 #include "output-json-netflow.h"
52 #include "log-cf-common.h"
53 #include "output-json-drop.h"
54 #include "output-eve-stream.h"
55 #include "log-httplog.h"
56 #include "output-json-http.h"
57 #include "output-json-dns.h"
58 #include "log-tlslog.h"
59 #include "log-tlsstore.h"
60 #include "output-json-tls.h"
61 #include "log-pcap.h"
62 // for SSHTxLogCondition
63 #include "app-layer-ssh.h"
64 #include "output-json-file.h"
65 #include "output-json-smtp.h"
66 #include "output-json-stats.h"
67 #include "log-tcp-data.h"
68 #include "log-stats.h"
69 #include "output-json-nfs.h"
70 #include "output-json-ftp.h"
71 // for misplaced EveFTPDataAddMetadata
72 #include "app-layer-ftp.h"
73 #include "output-json-smb.h"
74 #include "output-json-ike.h"
75 #include "output-json-dhcp.h"
76 #include "output-json-mqtt.h"
77 #include "output-json-pgsql.h"
78 #include "output-lua.h"
79 #include "output-json-dnp3.h"
80 #include "output-json-metadata.h"
81 #include "output-json-dcerpc.h"
82 #include "output-json-frame.h"
83 #include "app-layer-parser.h"
84 #include "output-filestore.h"
85 #include "output-json-arp.h"
86 
87 typedef struct RootLogger_ {
93 
94  TAILQ_ENTRY(RootLogger_) entries;
96 
97 /* List of registered root loggers. These are registered at start up and
98  * are independent of configuration. Later we will build a list of active
99  * loggers based on configuration. */
100 static TAILQ_HEAD(, RootLogger_) registered_loggers =
101  TAILQ_HEAD_INITIALIZER(registered_loggers);
102 
103 /* List of active root loggers. This means that at least one logger is enabled
104  * for each root logger type in the config. */
105 static TAILQ_HEAD(, RootLogger_) active_loggers =
106  TAILQ_HEAD_INITIALIZER(active_loggers);
107 
108 typedef struct LoggerThreadStoreNode_ {
109  void *thread_data;
110  TAILQ_ENTRY(LoggerThreadStoreNode_) entries;
112 
113 typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_) LoggerThreadStore;
114 
115 /**
116  * The list of all registered (known) output modules.
117  */
119 
120 /**
121  * Registry of flags to be updated on file rotation notification.
122  */
123 typedef struct OutputFileRolloverFlag_ {
124  int *flag;
125 
126  TAILQ_ENTRY(OutputFileRolloverFlag_) entries;
128 
129 static SCMutex output_file_rotation_mutex = SCMUTEX_INITIALIZER;
130 
131 TAILQ_HEAD(, OutputFileRolloverFlag_) output_file_rotation_flags =
132  TAILQ_HEAD_INITIALIZER(output_file_rotation_flags);
133 
134 void OutputRegisterRootLoggers(void);
135 void OutputRegisterLoggers(void);
136 
137 /**
138  * \brief Register an output module.
139  *
140  * This function will register an output module so it can be
141  * configured with the configuration file.
142  *
143  * \retval Returns 0 on success, -1 on failure.
144  */
145 void OutputRegisterModule(const char *name, const char *conf_name,
146  OutputInitFunc InitFunc)
147 {
148  OutputModule *module = SCCalloc(1, sizeof(*module));
149  if (unlikely(module == NULL))
150  goto error;
151 
152  module->name = name;
153  module->conf_name = conf_name;
154  module->InitFunc = InitFunc;
155  TAILQ_INSERT_TAIL(&output_modules, module, entries);
156 
157  SCLogDebug("Output module \"%s\" registered.", name);
158 
159  return;
160 
161 error:
162  FatalError("Fatal error encountered in OutputRegisterModule. Exiting...");
163 }
164 
165 /**
166  * \brief Register a packet output module.
167  *
168  * This function will register an output module so it can be
169  * configured with the configuration file.
170  *
171  * \retval Returns 0 on success, -1 on failure.
172  */
173 void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name,
174  OutputInitFunc InitFunc, OutputPacketLoggerFunctions *output_module_functions)
175 {
176  if (unlikely(output_module_functions->LogFunc == NULL ||
177  output_module_functions->ConditionFunc == NULL)) {
178  goto error;
179  }
180 
181  OutputModule *module = SCCalloc(1, sizeof(*module));
182  if (unlikely(module == NULL)) {
183  goto error;
184  }
185 
186  module->logger_id = id;
187  module->name = name;
188  module->conf_name = conf_name;
189  module->InitFunc = InitFunc;
190  module->PacketLogFunc = output_module_functions->LogFunc;
191  module->PacketFlushFunc = output_module_functions->FlushFunc;
192  module->PacketConditionFunc = output_module_functions->ConditionFunc;
193  module->ThreadInit = output_module_functions->ThreadInitFunc;
194  module->ThreadDeinit = output_module_functions->ThreadDeinitFunc;
195  TAILQ_INSERT_TAIL(&output_modules, module, entries);
196 
197  SCLogDebug("Packet logger \"%s\" registered.", name);
198  return;
199 error:
200  FatalError("Fatal error encountered. Exiting...");
201 }
202 
203 /**
204  * \brief Register a packet output sub-module.
205  *
206  * This function will register an output module so it can be
207  * configured with the configuration file.
208  *
209  * \retval Returns 0 on success, -1 on failure.
210  */
211 void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name,
212  const char *conf_name, OutputInitSubFunc InitFunc,
213  OutputPacketLoggerFunctions *output_logger_functions)
214 {
215  if (unlikely(output_logger_functions->LogFunc == NULL ||
216  output_logger_functions->ConditionFunc == NULL)) {
217  goto error;
218  }
219 
220  OutputModule *module = SCCalloc(1, sizeof(*module));
221  if (unlikely(module == NULL)) {
222  goto error;
223  }
224 
225  module->logger_id = id;
226  module->name = name;
227  module->conf_name = conf_name;
228  module->parent_name = parent_name;
229  module->InitSubFunc = InitFunc;
230  module->PacketLogFunc = output_logger_functions->LogFunc;
231  module->PacketFlushFunc = output_logger_functions->FlushFunc;
232  module->PacketConditionFunc = output_logger_functions->ConditionFunc;
233  module->ThreadInit = output_logger_functions->ThreadInitFunc;
234  module->ThreadDeinit = output_logger_functions->ThreadDeinitFunc;
235  TAILQ_INSERT_TAIL(&output_modules, module, entries);
236 
237  SCLogDebug("Packet logger \"%s\" registered.", name);
238  return;
239 error:
240  FatalError("Fatal error encountered. Exiting...");
241 }
242 
243 /**
244  * \brief Wrapper function for tx output modules.
245  *
246  * This function will register an output module so it can be
247  * configured with the configuration file.
248  *
249  * \retval Returns 0 on success, -1 on failure.
250  */
251 static void OutputRegisterTxModuleWrapper(LoggerId id, const char *name, const char *conf_name,
252  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress,
253  int ts_log_progress, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit,
254  ThreadDeinitFunc ThreadDeinit)
255 {
256  if (unlikely(TxLogFunc == NULL)) {
257  goto error;
258  }
259 
260  OutputModule *module = SCCalloc(1, sizeof(*module));
261  if (unlikely(module == NULL)) {
262  goto error;
263  }
264 
265  module->logger_id = id;
266  module->name = name;
267  module->conf_name = conf_name;
268  module->InitFunc = InitFunc;
269  module->TxLogFunc = TxLogFunc;
270  module->TxLogCondition = TxLogCondition;
271  module->alproto = alproto;
272  module->tc_log_progress = tc_log_progress;
273  module->ts_log_progress = ts_log_progress;
274  module->ThreadInit = ThreadInit;
275  module->ThreadDeinit = ThreadDeinit;
276  TAILQ_INSERT_TAIL(&output_modules, module, entries);
277 
278  SCLogDebug("Tx logger \"%s\" registered.", name);
279  return;
280 error:
281  FatalError("Fatal error encountered. Exiting...");
282 }
283 
284 static void OutputRegisterTxSubModuleWrapper(LoggerId id, const char *parent_name, const char *name,
285  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
286  int tc_log_progress, int ts_log_progress, TxLoggerCondition TxLogCondition,
287  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
288 {
289  if (unlikely(TxLogFunc == NULL)) {
290  goto error;
291  }
292 
293  OutputModule *module = SCCalloc(1, sizeof(*module));
294  if (unlikely(module == NULL)) {
295  goto error;
296  }
297 
298  module->logger_id = id;
299  module->name = name;
300  module->conf_name = conf_name;
301  module->parent_name = parent_name;
302  module->InitSubFunc = InitFunc;
303  module->TxLogFunc = TxLogFunc;
304  module->TxLogCondition = TxLogCondition;
305  module->alproto = alproto;
306  module->tc_log_progress = tc_log_progress;
307  module->ts_log_progress = ts_log_progress;
308  module->ThreadInit = ThreadInit;
309  module->ThreadDeinit = ThreadDeinit;
310  TAILQ_INSERT_TAIL(&output_modules, module, entries);
311 
312  SCLogDebug("Tx logger for alproto %d \"%s\" registered.", alproto, name);
313  return;
314 error:
315  FatalError("Fatal error encountered. Exiting...");
316 }
317 
318 /**
319  * \brief Register a tx output module with condition.
320  *
321  * This function will register an output module so it can be
322  * configured with the configuration file.
323  *
324  * \retval Returns 0 on success, -1 on failure.
325  */
326 void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name,
327  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
328  TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
329 {
330  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1,
331  TxLogCondition, ThreadInit, ThreadDeinit);
332 }
333 
334 void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name,
335  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
336  TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
337 {
338  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
339  -1, -1, TxLogCondition, ThreadInit, ThreadDeinit);
340 }
341 
342 /**
343  * \brief Register a tx output module with progress.
344  *
345  * This function will register an output module so it can be
346  * configured with the configuration file.
347  *
348  * \retval Returns 0 on success, -1 on failure.
349  */
350 void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name,
351  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress,
352  int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
353 {
354  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc,
355  tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit);
356 }
357 
358 void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name,
359  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
360  int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit,
361  ThreadDeinitFunc ThreadDeinit)
362 {
363  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
364  tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit);
365 }
366 
367 /**
368  * \brief Register a tx output module.
369  *
370  * This function will register an output module so it can be
371  * configured with the configuration file.
372  *
373  * \retval Returns 0 on success, -1 on failure.
374  */
375 void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name,
376  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit,
377  ThreadDeinitFunc ThreadDeinit)
378 {
379  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, NULL,
380  ThreadInit, ThreadDeinit);
381 }
382 
383 void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name,
384  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
385  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
386 {
387  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
388  -1, -1, NULL, ThreadInit, ThreadDeinit);
389 }
390 
391 /**
392  * \brief Register a file output sub-module.
393  *
394  * This function will register an output module so it can be
395  * configured with the configuration file.
396  *
397  * \retval Returns 0 on success, -1 on failure.
398  */
399 void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name,
400  const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc,
401  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
402 {
403  if (unlikely(FileLogFunc == NULL)) {
404  goto error;
405  }
406 
407  OutputModule *module = SCCalloc(1, sizeof(*module));
408  if (unlikely(module == NULL)) {
409  goto error;
410  }
411 
412  module->logger_id = id;
413  module->name = name;
414  module->conf_name = conf_name;
415  module->parent_name = parent_name;
416  module->InitSubFunc = InitFunc;
417  module->FileLogFunc = FileLogFunc;
418  module->ThreadInit = ThreadInit;
419  module->ThreadDeinit = ThreadDeinit;
420  TAILQ_INSERT_TAIL(&output_modules, module, entries);
421 
422  SCLogDebug("File logger \"%s\" registered.", name);
423  return;
424 error:
425  FatalError("Fatal error encountered. Exiting...");
426 }
427 
428 /**
429  * \brief Register a file data output module.
430  *
431  * This function will register an output module so it can be
432  * configured with the configuration file.
433  *
434  * \retval Returns 0 on success, -1 on failure.
435  */
436 void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name,
437  OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit,
438  ThreadDeinitFunc ThreadDeinit)
439 {
440  if (unlikely(FiledataLogFunc == NULL)) {
441  goto error;
442  }
443 
444  OutputModule *module = SCCalloc(1, sizeof(*module));
445  if (unlikely(module == NULL)) {
446  goto error;
447  }
448 
449  module->logger_id = id;
450  module->name = name;
451  module->conf_name = conf_name;
452  module->InitFunc = InitFunc;
453  module->FiledataLogFunc = FiledataLogFunc;
454  module->ThreadInit = ThreadInit;
455  module->ThreadDeinit = ThreadDeinit;
456  TAILQ_INSERT_TAIL(&output_modules, module, entries);
457 
458  SCLogDebug("Filedata logger \"%s\" registered.", name);
459  return;
460 error:
461  FatalError("Fatal error encountered. Exiting...");
462 }
463 
464 /**
465  * \brief Register a flow output sub-module.
466  *
467  * This function will register an output module so it can be
468  * configured with the configuration file.
469  *
470  * \retval Returns 0 on success, -1 on failure.
471  */
472 void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name,
473  const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc,
474  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
475 {
476  if (unlikely(FlowLogFunc == NULL)) {
477  goto error;
478  }
479 
480  OutputModule *module = SCCalloc(1, sizeof(*module));
481  if (unlikely(module == NULL)) {
482  goto error;
483  }
484 
485  module->logger_id = id;
486  module->name = name;
487  module->conf_name = conf_name;
488  module->parent_name = parent_name;
489  module->InitSubFunc = InitFunc;
490  module->FlowLogFunc = FlowLogFunc;
491  module->ThreadInit = ThreadInit;
492  module->ThreadDeinit = ThreadDeinit;
493  TAILQ_INSERT_TAIL(&output_modules, module, entries);
494 
495  SCLogDebug("Flow logger \"%s\" registered.", name);
496  return;
497 error:
498  FatalError("Fatal error encountered. Exiting...");
499 }
500 
501 /**
502  * \brief Register a streaming data output module.
503  *
504  * This function will register an output module so it can be
505  * configured with the configuration file.
506  *
507  * \retval Returns 0 on success, -1 on failure.
508  */
509 void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name,
510  OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc,
511  enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit,
512  ThreadDeinitFunc ThreadDeinit)
513 {
514  if (unlikely(StreamingLogFunc == NULL)) {
515  goto error;
516  }
517 
518  OutputModule *module = SCCalloc(1, sizeof(*module));
519  if (unlikely(module == NULL)) {
520  goto error;
521  }
522 
523  module->logger_id = id;
524  module->name = name;
525  module->conf_name = conf_name;
526  module->InitFunc = InitFunc;
527  module->StreamingLogFunc = StreamingLogFunc;
528  module->stream_type = stream_type;
529  module->ThreadInit = ThreadInit;
530  module->ThreadDeinit = ThreadDeinit;
531  TAILQ_INSERT_TAIL(&output_modules, module, entries);
532 
533  SCLogDebug("Streaming logger \"%s\" registered.", name);
534  return;
535 error:
536  FatalError("Fatal error encountered. Exiting...");
537 }
538 
539 /**
540  * \brief Register a stats data output module.
541  *
542  * This function will register an output module so it can be
543  * configured with the configuration file.
544  *
545  * \retval Returns 0 on success, -1 on failure.
546  */
547 void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name,
548  OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit,
549  ThreadDeinitFunc ThreadDeinit)
550 {
551  if (unlikely(StatsLogFunc == NULL)) {
552  goto error;
553  }
554 
555  OutputModule *module = SCCalloc(1, sizeof(*module));
556  if (unlikely(module == NULL)) {
557  goto error;
558  }
559 
560  module->logger_id = id;
561  module->name = name;
562  module->conf_name = conf_name;
563  module->InitFunc = InitFunc;
564  module->StatsLogFunc = StatsLogFunc;
565  module->ThreadInit = ThreadInit;
566  module->ThreadDeinit = ThreadDeinit;
567  TAILQ_INSERT_TAIL(&output_modules, module, entries);
568 
569  SCLogDebug("Stats logger \"%s\" registered.", name);
570  return;
571 error:
572  FatalError("Fatal error encountered. Exiting...");
573 }
574 
575 /**
576  * \brief Register a stats data output sub-module.
577  *
578  * This function will register an output module so it can be
579  * configured with the configuration file.
580  *
581  * \retval Returns 0 on success, -1 on failure.
582  */
583 void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name,
584  const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc,
585  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
586 {
587  if (unlikely(StatsLogFunc == NULL)) {
588  goto error;
589  }
590 
591  OutputModule *module = SCCalloc(1, sizeof(*module));
592  if (unlikely(module == NULL)) {
593  goto error;
594  }
595 
596  module->logger_id = id;
597  module->name = name;
598  module->conf_name = conf_name;
599  module->parent_name = parent_name;
600  module->InitSubFunc = InitFunc;
601  module->StatsLogFunc = StatsLogFunc;
602  module->ThreadInit = ThreadInit;
603  module->ThreadDeinit = ThreadDeinit;
604  TAILQ_INSERT_TAIL(&output_modules, module, entries);
605 
606  SCLogDebug("Stats logger \"%s\" registered.", name);
607  return;
608 error:
609  FatalError("Fatal error encountered. Exiting...");
610 }
611 
612 /**
613  * \brief Get an output module by name.
614  *
615  * \retval The OutputModule with the given name or NULL if no output module
616  * with the given name is registered.
617  */
619 {
620  OutputModule *module;
621 
622  TAILQ_FOREACH(module, &output_modules, entries) {
623  if (strcmp(module->conf_name, conf_name) == 0)
624  return module;
625  }
626 
627  return NULL;
628 }
629 
630 static EveJsonSimpleAppLayerLogger *simple_json_applayer_loggers;
631 
632 /**
633  * \brief Deregister all modules. Useful for a memory clean exit.
634  */
636 {
637  OutputModule *module;
638 
639  while ((module = TAILQ_FIRST(&output_modules))) {
640  TAILQ_REMOVE(&output_modules, module, entries);
641  SCFree(module);
642  }
643  SCFree(simple_json_applayer_loggers);
644  simple_json_applayer_loggers = NULL;
645 }
646 
647 static int drop_loggers = 0;
648 
650 {
651  if (drop_loggers)
652  return -1;
653  drop_loggers++;
654  return 0;
655 }
656 
658 {
659  if (drop_loggers)
660  drop_loggers--;
661 }
662 
663 /**
664  * \brief Register a flag for file rotation notification.
665  *
666  * \param flag A pointer that will be set to 1 when file rotation is
667  * requested.
668  */
670 {
671  OutputFileRolloverFlag *flag_entry = SCCalloc(1, sizeof(*flag_entry));
672  if (unlikely(flag_entry == NULL)) {
673  SCLogError("Failed to allocate memory to register file rotation flag");
674  return;
675  }
676  flag_entry->flag = flag;
677  SCMutexLock(&output_file_rotation_mutex);
678  TAILQ_INSERT_TAIL(&output_file_rotation_flags, flag_entry, entries);
679  SCMutexUnlock(&output_file_rotation_mutex);
680 }
681 
682 /**
683  * \brief Unregister a file rotation flag.
684  *
685  * Note that it is safe to call this function with a flag that may not
686  * have been registered, in which case this function won't do
687  * anything.
688  *
689  * \param flag A pointer that has been previously registered for file
690  * rotation notifications.
691  */
693 {
694  OutputFileRolloverFlag *entry, *next;
695  SCMutexLock(&output_file_rotation_mutex);
696  for (entry = TAILQ_FIRST(&output_file_rotation_flags); entry != NULL;
697  entry = next) {
698  next = TAILQ_NEXT(entry, entries);
699  if (entry->flag == flag) {
700  TAILQ_REMOVE(&output_file_rotation_flags, entry, entries);
701  SCMutexUnlock(&output_file_rotation_mutex);
702  SCFree(entry);
703  return;
704  }
705  }
706  SCMutexUnlock(&output_file_rotation_mutex);
707 }
708 
709 /**
710  * \brief Notifies all registered file rotation notification flags.
711  */
713  OutputFileRolloverFlag *flag = NULL;
714  OutputFileRolloverFlag *tflag;
715  SCMutexLock(&output_file_rotation_mutex);
716  TAILQ_FOREACH_SAFE (flag, &output_file_rotation_flags, entries, tflag) {
717  *(flag->flag) = 1;
718  }
719  SCMutexUnlock(&output_file_rotation_mutex);
720 }
721 
722 TmEcode OutputLoggerFlush(ThreadVars *tv, Packet *p, void *thread_data)
723 {
724  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
725  RootLogger *logger = TAILQ_FIRST(&active_loggers);
726  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
727  while (logger && thread_store_node) {
728  if (logger->FlushFunc)
729  logger->FlushFunc(tv, p, thread_store_node->thread_data);
730 
731  logger = TAILQ_NEXT(logger, entries);
732  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
733  }
734  return TM_ECODE_OK;
735 }
736 
737 TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
738 {
739  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
740  RootLogger *logger = TAILQ_FIRST(&active_loggers);
741  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
742  while (logger && thread_store_node) {
743  logger->LogFunc(tv, p, thread_store_node->thread_data);
744 
745  logger = TAILQ_NEXT(logger, entries);
746  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
747  }
748  return TM_ECODE_OK;
749 }
750 
751 TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
752 {
753  LoggerThreadStore *thread_store = SCCalloc(1, sizeof(*thread_store));
754  if (thread_store == NULL) {
755  return TM_ECODE_FAILED;
756  }
757  TAILQ_INIT(thread_store);
758  *data = (void *)thread_store;
759 
760  RootLogger *logger;
761  TAILQ_FOREACH(logger, &active_loggers, entries) {
762 
763  void *child_thread_data = NULL;
764  if (logger->ThreadInit != NULL) {
765  if (logger->ThreadInit(tv, initdata, &child_thread_data) == TM_ECODE_OK) {
766  LoggerThreadStoreNode *thread_store_node =
767  SCCalloc(1, sizeof(*thread_store_node));
768  if (thread_store_node == NULL) {
769  /* Undo everything, calling de-init will take care
770  * of that. */
771  OutputLoggerThreadDeinit(tv, thread_store);
772  return TM_ECODE_FAILED;
773  }
774  thread_store_node->thread_data = child_thread_data;
775  TAILQ_INSERT_TAIL(thread_store, thread_store_node, entries);
776  }
777  }
778  }
779  return TM_ECODE_OK;
780 }
781 
783 {
784  if (thread_data == NULL)
785  return TM_ECODE_FAILED;
786 
787  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
788  RootLogger *logger = TAILQ_FIRST(&active_loggers);
789  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
790  while (logger && thread_store_node) {
791  if (logger->ThreadDeinit != NULL) {
792  logger->ThreadDeinit(tv, thread_store_node->thread_data);
793  }
794  logger = TAILQ_NEXT(logger, entries);
795  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
796  }
797 
798  /* Free the thread store. */
799  while ((thread_store_node = TAILQ_FIRST(thread_store)) != NULL) {
800  TAILQ_REMOVE(thread_store, thread_store_node, entries);
801  SCFree(thread_store_node);
802  }
803  SCFree(thread_store);
804 
805  return TM_ECODE_OK;
806 }
807 
809  OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
810 {
811  BUG_ON(LogFunc == NULL);
812 
813  RootLogger *logger = SCCalloc(1, sizeof(*logger));
814  if (logger == NULL) {
815  FatalError("failed to alloc root logger");
816  }
817  logger->ThreadInit = ThreadInit;
818  logger->ThreadDeinit = ThreadDeinit;
819  logger->LogFunc = LogFunc;
820  logger->ActiveCntFunc = ActiveCntFunc;
821  TAILQ_INSERT_TAIL(&registered_loggers, logger, entries);
822 }
823 
824 static void OutputRegisterActiveLogger(RootLogger *reg)
825 {
826  RootLogger *logger = SCCalloc(1, sizeof(*logger));
827  if (logger == NULL) {
828  FatalError("failed to alloc root logger");
829  }
830  logger->ThreadInit = reg->ThreadInit;
831  logger->ThreadDeinit = reg->ThreadDeinit;
832  logger->LogFunc = reg->LogFunc;
833  logger->ActiveCntFunc = reg->ActiveCntFunc;
834  TAILQ_INSERT_TAIL(&active_loggers, logger, entries);
835 }
836 
838 {
839  RootLogger *logger = TAILQ_FIRST(&registered_loggers);
840  while (logger) {
841  uint32_t cnt = logger->ActiveCntFunc();
842  if (cnt) {
843  OutputRegisterActiveLogger(logger);
844  }
845 
846  logger = TAILQ_NEXT(logger, entries);
847  }
848 }
849 
851 {
852  RootLogger *logger;
853  while ((logger = TAILQ_FIRST(&active_loggers)) != NULL) {
854  TAILQ_REMOVE(&active_loggers, logger, entries);
855  SCFree(logger);
856  }
857 }
858 
860 {
863 }
864 
866 {
867  if (alproto < g_alproto_max) {
868  return &simple_json_applayer_loggers[alproto];
869  }
870  return NULL;
871 }
872 
873 static void RegisterSimpleJsonApplayerLogger(
874  AppProto alproto, EveJsonSimpleTxLogFunc LogTx, const char *name)
875 {
876  simple_json_applayer_loggers[alproto].LogTx = LogTx;
877  if (name) {
878  simple_json_applayer_loggers[alproto].name = name;
879  } else {
880  simple_json_applayer_loggers[alproto].name = AppProtoToString(alproto);
881  }
882 }
883 
884 /**
885  * \brief Register all root loggers.
886  */
888 {
889  simple_json_applayer_loggers = SCCalloc(g_alproto_max, sizeof(EveJsonSimpleAppLayerLogger));
890  if (unlikely(simple_json_applayer_loggers == NULL)) {
891  FatalError("Failed to allocate simple_json_applayer_loggers");
892  }
893  // ALPROTO_HTTP1 special: uses some options flags
894  RegisterSimpleJsonApplayerLogger(ALPROTO_FTP, (EveJsonSimpleTxLogFunc)EveFTPLogCommand, NULL);
895  // ALPROTO_SMTP special: uses state
896  RegisterSimpleJsonApplayerLogger(
898  // no cast here but done in rust for SSHTransaction
899  RegisterSimpleJsonApplayerLogger(ALPROTO_SSH, (EveJsonSimpleTxLogFunc)SCSshLogJson, NULL);
900  // ALPROTO_SMB special: uses state
901  // ALPROTO_DCERPC special: uses state
902  RegisterSimpleJsonApplayerLogger(ALPROTO_DNS, (EveJsonSimpleTxLogFunc)AlertJsonDns, NULL);
903  // either need a cast here or in rust for ModbusTransaction, done here
904  RegisterSimpleJsonApplayerLogger(
905  ALPROTO_MODBUS, (EveJsonSimpleTxLogFunc)rs_modbus_to_json, NULL);
906  RegisterSimpleJsonApplayerLogger(ALPROTO_ENIP, (EveJsonSimpleTxLogFunc)SCEnipLoggerLog, NULL);
907  RegisterSimpleJsonApplayerLogger(ALPROTO_DNP3, (EveJsonSimpleTxLogFunc)AlertJsonDnp3, NULL);
908  // ALPROTO_NFS special: uses state
909  // underscore instead of dash for ftp_data
910  RegisterSimpleJsonApplayerLogger(
912  RegisterSimpleJsonApplayerLogger(
913  ALPROTO_TFTP, (EveJsonSimpleTxLogFunc)rs_tftp_log_json_request, NULL);
914  // ALPROTO_IKE special: uses state
915  RegisterSimpleJsonApplayerLogger(
916  ALPROTO_KRB5, (EveJsonSimpleTxLogFunc)rs_krb5_log_json_response, NULL);
917  RegisterSimpleJsonApplayerLogger(ALPROTO_QUIC, (EveJsonSimpleTxLogFunc)rs_quic_to_json, NULL);
918  // ALPROTO_DHCP TODO missing
919  RegisterSimpleJsonApplayerLogger(ALPROTO_SIP, (EveJsonSimpleTxLogFunc)rs_sip_log_json, NULL);
920  RegisterSimpleJsonApplayerLogger(ALPROTO_RFB, (EveJsonSimpleTxLogFunc)rs_rfb_logger_log, NULL);
921  RegisterSimpleJsonApplayerLogger(ALPROTO_POP3, (EveJsonSimpleTxLogFunc)SCPop3LoggerLog, NULL);
922  RegisterSimpleJsonApplayerLogger(
924  RegisterSimpleJsonApplayerLogger(
926  RegisterSimpleJsonApplayerLogger(
927  ALPROTO_WEBSOCKET, (EveJsonSimpleTxLogFunc)rs_websocket_logger_log, NULL);
928  RegisterSimpleJsonApplayerLogger(
929  ALPROTO_LDAP, (EveJsonSimpleTxLogFunc)rs_ldap_logger_log, NULL);
930  RegisterSimpleJsonApplayerLogger(ALPROTO_DOH2, (EveJsonSimpleTxLogFunc)AlertJsonDoh2, NULL);
931  RegisterSimpleJsonApplayerLogger(
932  ALPROTO_TEMPLATE, (EveJsonSimpleTxLogFunc)rs_template_logger_log, NULL);
933  RegisterSimpleJsonApplayerLogger(ALPROTO_RDP, (EveJsonSimpleTxLogFunc)SCRdpToJson, NULL);
934  // special case : http2 is logged in http object
935  RegisterSimpleJsonApplayerLogger(
936  ALPROTO_HTTP2, (EveJsonSimpleTxLogFunc)rs_http2_log_json, "http");
937  // underscore instead of dash for bittorrent_dht
938  RegisterSimpleJsonApplayerLogger(ALPROTO_BITTORRENT_DHT,
939  (EveJsonSimpleTxLogFunc)SCBittorrentDhtLogger, "bittorrent_dht");
940 
946 }
947 
948 static int JsonGenericLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
949  void *state, void *tx, uint64_t tx_id, int dir)
950 {
951  OutputJsonThreadCtx *thread = thread_data;
953  if (al == NULL) {
954  return TM_ECODE_FAILED;
955  }
956 
957  SCJsonBuilder *js = CreateEveHeader(p, dir, al->name, NULL, thread->ctx);
958  if (unlikely(js == NULL)) {
959  return TM_ECODE_FAILED;
960  }
961 
962  if (!al->LogTx(tx, js)) {
963  goto error;
964  }
965 
966  OutputJsonBuilderBuffer(tv, p, p->flow, js, thread);
967  SCJbFree(js);
968 
969  return TM_ECODE_OK;
970 
971 error:
972  SCJbFree(js);
973  return TM_ECODE_FAILED;
974 }
975 
976 static int JsonGenericDirPacketLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
977  void *state, void *tx, uint64_t tx_id)
978 {
979  return JsonGenericLogger(tv, thread_data, p, f, state, tx, tx_id, LOG_DIR_PACKET);
980 }
981 
982 static int JsonGenericDirFlowLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
983  void *state, void *tx, uint64_t tx_id)
984 {
985  return JsonGenericLogger(tv, thread_data, p, f, state, tx, tx_id, LOG_DIR_FLOW);
986 }
987 
988 #define ARRAY_CAP_STEP 16
989 static EveJsonTxLoggerRegistrationData *preregistered_loggers = NULL;
990 static size_t preregistered_loggers_nb = 0;
991 static size_t preregistered_loggers_cap = 0;
992 
993 // Plugins can preregister logger with this function :
994 // When an app-layer plugin is loaded, it wants to register its logger
995 // But the plugin is loaded before loggers can register
996 // The preregistration data will later be used by OutputRegisterLoggers
998 {
999  if (preregistered_loggers_nb == preregistered_loggers_cap) {
1000  void *tmp = SCRealloc(
1001  preregistered_loggers, sizeof(EveJsonTxLoggerRegistrationData) *
1002  (preregistered_loggers_cap + ARRAY_CAP_STEP));
1003  if (tmp == NULL) {
1004  return 1;
1005  }
1006  preregistered_loggers_cap += ARRAY_CAP_STEP;
1007  preregistered_loggers = tmp;
1008  }
1009  preregistered_loggers[preregistered_loggers_nb] = reg_data;
1010  preregistered_loggers_nb++;
1011  return 0;
1012 }
1013 
1014 static TxLogger JsonLoggerFromDir(uint8_t dir)
1015 {
1016  if (dir == LOG_DIR_PACKET) {
1017  return JsonGenericDirPacketLogger;
1018  }
1019  BUG_ON(dir != LOG_DIR_FLOW);
1020  return JsonGenericDirFlowLogger;
1021 }
1022 
1023 /**
1024  * \brief Register all non-root logging modules.
1025  */
1027 {
1028  /* custom format log*/
1030 
1031  LuaLogRegister();
1032  /* fast log */
1034  /* debug log */
1036  /* syslog log */
1040  /* json log */
1042  /* email logs */
1044  /* http log */
1047  OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "LogHttp2Log", "eve-log.http2",
1048  OutputJsonLogInitSub, ALPROTO_HTTP2, JsonGenericDirFlowLogger, HTTP2StateClosed,
1049  HTTP2StateClosed, JsonLogThreadInit, JsonLogThreadDeinit);
1050  /* tls log */
1054  /* ssh */
1055  OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_TX, "eve-log", "JsonSshLog", "eve-log.ssh",
1056  OutputJsonLogInitSub, ALPROTO_SSH, JsonGenericDirFlowLogger, SSHTxLogCondition,
1058  /* pcap log */
1059  PcapLogRegister();
1060  /* file log */
1063  /* dns */
1065  /* modbus */
1066  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonModbusLog", "eve-log.modbus",
1067  OutputJsonLogInitSub, ALPROTO_MODBUS, JsonGenericDirFlowLogger, JsonLogThreadInit,
1069 
1070  SCLogDebug("modbus json logger registered.");
1071  /* tcp streaming data */
1073  /* log stats */
1075 
1078  /* flow/netflow */
1081  /* json stats */
1083 
1084  /* DNP3. */
1087 
1088  /* NFS JSON logger. */
1090  /* TFTP JSON logger. */
1091  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTFTPLog", "eve-log.tftp",
1092  OutputJsonLogInitSub, ALPROTO_TFTP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1094 
1095  SCLogDebug("TFTP JSON logger registered.");
1096  /* FTP and FTP-DATA JSON loggers. */
1097  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
1098  OutputJsonLogInitSub, ALPROTO_FTP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1100  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
1101  OutputJsonLogInitSub, ALPROTO_FTPDATA, JsonGenericDirFlowLogger, JsonLogThreadInit,
1103  SCLogDebug("FTP JSON logger registered.");
1104 
1105  /* SMB JSON logger. */
1107  /* IKE JSON logger. */
1109  /* KRB5 JSON logger. */
1110  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonKRB5Log", "eve-log.krb5",
1111  OutputJsonLogInitSub, ALPROTO_KRB5, JsonGenericDirPacketLogger, JsonLogThreadInit,
1113 
1114  SCLogDebug("KRB5 JSON logger registered.");
1115  /* QUIC JSON logger. */
1116  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonQuicLog", "eve-log.quic",
1117  OutputJsonLogInitSub, ALPROTO_QUIC, JsonGenericDirPacketLogger, JsonLogThreadInit,
1119 
1120  SCLogDebug("quic json logger registered.");
1121  /* DHCP JSON logger. */
1123 
1124  /* SIP JSON logger. */
1125  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSIPLog", "eve-log.sip",
1126  OutputJsonLogInitSub, ALPROTO_SIP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1128 
1129  SCLogDebug("SIP JSON logger registered.");
1130  /* RFB JSON logger. */
1131  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRFBLog", "eve-log.rfb",
1132  OutputJsonLogInitSub, ALPROTO_RFB, JsonGenericDirPacketLogger, JsonLogThreadInit,
1134  /* MQTT JSON logger. */
1136  /* Pgsql JSON logger. */
1138  /* WebSocket JSON logger. */
1139  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonWebSocketLog", "eve-log.websocket",
1140  OutputJsonLogInitSub, ALPROTO_WEBSOCKET, JsonGenericDirPacketLogger, JsonLogThreadInit,
1142  /* Enip JSON logger. */
1143  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonEnipLog", "eve-log.enip",
1144  OutputJsonLogInitSub, ALPROTO_ENIP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1146  /* Ldap JSON logger. */
1147  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonLdapLog", "eve-log.ldap",
1148  OutputJsonLogInitSub, ALPROTO_LDAP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1150  /* DoH2 JSON logger. */
1152  /* POP3 JSON logger */
1153  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonPop3Log", "eve-log.pop3",
1154  OutputJsonLogInitSub, ALPROTO_POP3, JsonGenericDirFlowLogger, JsonLogThreadInit,
1156  /* Template JSON logger. */
1157  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTemplateLog", "eve-log.template",
1158  OutputJsonLogInitSub, ALPROTO_TEMPLATE, JsonGenericDirPacketLogger, JsonLogThreadInit,
1160  /* RDP JSON logger. */
1161  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRdpLog", "eve-log.rdp",
1162  OutputJsonLogInitSub, ALPROTO_RDP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1164  SCLogDebug("rdp json logger registered.");
1165  /* DCERPC JSON logger. */
1167  /* app layer frames */
1169  /* BitTorrent DHT JSON logger */
1170  if (SCConfGetNode("app-layer.protocols.bittorrent-dht") != NULL) {
1171  /* Register as an eve sub-module. */
1172  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonBitTorrentDHTLog",
1173  "eve-log.bittorrent-dht", OutputJsonLogInitSub, ALPROTO_BITTORRENT_DHT,
1174  JsonGenericDirPacketLogger, JsonLogThreadInit, JsonLogThreadDeinit);
1175  }
1176  /* ARP JSON logger */
1178 
1179  for (size_t i = 0; i < preregistered_loggers_nb; i++) {
1180  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", preregistered_loggers[i].logname,
1181  preregistered_loggers[i].confname, OutputJsonLogInitSub,
1182  preregistered_loggers[i].alproto, JsonLoggerFromDir(preregistered_loggers[i].dir),
1184  SCLogDebug(
1185  "%s JSON logger registered.", AppProtoToString(preregistered_loggers[i].alproto));
1186  RegisterSimpleJsonApplayerLogger(preregistered_loggers[i].alproto,
1187  (EveJsonSimpleTxLogFunc)preregistered_loggers[i].LogTx, NULL);
1188  }
1189 }
RootLogger_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.c:91
log-stats.h
JsonMQTTAddMetadata
bool JsonMQTTAddMetadata(void *vtx, SCJsonBuilder *js)
Definition: output-json-mqtt.c:63
OutputModule_::parent_name
const char * parent_name
Definition: output.h:61
OutputFileRolloverFlag
OutputFileRolloverFlag
Definition: output.c:127
LogTlsStoreRegister
void LogTlsStoreRegister(void)
Definition: log-tlsstore.c:437
tm-threads.h
OutputModule_::FileLogFunc
SCFileLogger FileLogFunc
Definition: output.h:73
output-json-ftp.h
OutputDropLoggerEnable
int OutputDropLoggerEnable(void)
Definition: output.c:649
OutputRegisterStreamingModule
void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc, enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming data output module.
Definition: output.c:509
LoggerThreadStoreNode
LoggerThreadStoreNode
Definition: output.c:111
OutputLogFunc
TmEcode(* OutputLogFunc)(ThreadVars *, Packet *, void *)
Definition: output.h:53
JsonDoh2LogRegister
void JsonDoh2LogRegister(void)
Definition: output-json-dns.c:677
app-layer-ssh.h
JsonDCERPCLogRegister
void JsonDCERPCLogRegister(void)
Definition: output-json-dcerpc.c:67
OutputTxLoggerRegister
void OutputTxLoggerRegister(void)
Definition: output-tx.c:648
alert-debuglog.h
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
JsonPgsqlLogRegister
void JsonPgsqlLogRegister(void)
Definition: output-json-pgsql.c:184
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:47
OutputJsonThreadCtx_::ctx
OutputJsonCtx * ctx
Definition: output-json.h:84
JsonTlsLogJSONExtended
bool JsonTlsLogJSONExtended(void *vtx, SCJsonBuilder *tjs)
Definition: output-json-tls.c:449
OutputModule_::PacketFlushFunc
PacketLogger PacketFlushFunc
Definition: output.h:69
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:49
OutputRegisterTxSubModuleWithProgress
void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:358
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb)
Definition: app-layer-ftp.c:1379
JsonSMBLogRegister
void JsonSMBLogRegister(void)
Definition: output-json-smb.c:151
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:39
OutputRegisterRootLogger
void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
Definition: output.c:808
output-json-mqtt.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
output-eve-stream.h
OutputFileLoggerRegister
void OutputFileLoggerRegister(void)
Definition: output-file.c:235
RootLogger_::FlushFunc
OutputFlushFunc FlushFunc
Definition: output.c:89
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
OutputPacketLoggerFunctions_::FlushFunc
PacketLogger FlushFunc
Definition: output.h:89
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:48
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:85
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:57
SCFileLogger
int(* SCFileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, void *tx, const uint64_t tx_id, uint8_t direction)
Definition: output-file.h:48
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:71
SCEveJsonSimpleGetLogger
EveJsonSimpleAppLayerLogger * SCEveJsonSimpleGetLogger(AppProto alproto)
Definition: output.c:865
CreateEveHeader
SCJsonBuilder * CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Definition: output-json.c:834
JsonLogThreadInit
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
Definition: output-json-common.c:99
OutputModule_::name
const char * name
Definition: output.h:59
Flow_
Flow data structure.
Definition: flow.h:356
LogTlsLogRegister
void LogTlsLogRegister(void)
Definition: log-tlslog.c:499
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:58
LoggerId
LoggerId
Definition: suricata-common.h:469
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
AlertFastLogRegister
void AlertFastLogRegister(void)
Definition: alert-fastlog.c:77
output-json-pgsql.h
JsonFileLogRegister
void JsonFileLogRegister(void)
Definition: output-json-file.c:352
AlertJsonDns
bool AlertJsonDns(void *txptr, SCJsonBuilder *js)
Definition: output-json-dns.c:251
output-json-frame.h
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:81
OutputRegisterStatsSubModule
void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a stats data output sub-module.
Definition: output.c:583
output-json-netflow.h
JsonDNP3LogRegister
void JsonDNP3LogRegister(void)
Definition: output-json-dnp3.c:366
LogCustomFormatRegister
void LogCustomFormatRegister(void)
Definition: log-cf-common.c:271
SCOutputEvePreRegisterLogger
int SCOutputEvePreRegisterLogger(EveJsonTxLoggerRegistrationData reg_data)
Definition: output.c:997
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
output-json-arp.h
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:618
output-json-tls.h
OutputInitFunc
OutputInitResult(* OutputInitFunc)(SCConfNode *)
Definition: output.h:51
SSHTxLogCondition
bool SSHTxLogCondition(ThreadVars *tv, const Packet *p, void *state, void *tx, uint64_t tx_id)
Definition: app-layer-ssh.c:76
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:59
OutputRegisterTxSubModule
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:383
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:837
AlertSyslogRegister
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
Definition: alert-syslog.c:384
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:77
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition: app-layer-protos.h:65
JsonDHCPLogRegister
void JsonDHCPLogRegister(void)
Definition: output-json-dhcp.c:145
TxLogger
int(* TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
Transaction logger function pointer type.
Definition: output-tx.h:34
FlowLogger
int(* FlowLogger)(ThreadVars *, void *thread_data, Flow *f)
Flow logger function pointer type.
Definition: output-flow.h:36
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
OutputJsonBuilderBuffer
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:992
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
PcapLogRegister
void PcapLogRegister(void)
Definition: log-pcap.c:219
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:63
OutputRegisterFiledataModule
void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file data output module.
Definition: output.c:436
SCFiledataLogger
int(* SCFiledataLogger)(ThreadVars *, void *thread_data, const Packet *, File *, void *tx, const uint64_t tx_id, const uint8_t *, uint32_t, uint8_t, uint8_t dir)
File-data logger function pointer type.
Definition: output-filedata.h:51
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:40
app-layer-ftp.h
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:68
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
OutputModule_::FiledataLogFunc
SCFiledataLogger FiledataLogFunc
Definition: output.h:74
JsonStatsLogRegister
void JsonStatsLogRegister(void)
Definition: output-json-stats.c:501
LogTcpDataLogRegister
void LogTcpDataLogRegister(void)
Definition: log-tcp-data.c:46
OutputRegisterRootLoggers
void OutputRegisterRootLoggers(void)
Register all root loggers.
Definition: output.c:887
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output.c:782
OutputRegisterTxModule
void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module.
Definition: output.c:375
OutputModule_::alproto
AppProto alproto
Definition: output.h:78
JsonTlsLogRegister
void JsonTlsLogRegister(void)
Definition: output-json-tls.c:658
OutputRegisterFileSubModule
void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file output sub-module.
Definition: output.c:399
alert-syslog.h
JsonFlowLogRegister
void JsonFlowLogRegister(void)
Definition: output-json-flow.c:433
OutputPacketLoggerFunctions_::ConditionFunc
PacketLogCondition ConditionFunc
Definition: output.h:90
TmModuleLoggerRegister
void TmModuleLoggerRegister(void)
Definition: output.c:859
output-json-dcerpc.h
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
JsonPgsqlAddMetadata
bool JsonPgsqlAddMetadata(void *vtx, SCJsonBuilder *jb)
Definition: output-json-pgsql.c:62
OutputJsonRegister
void OutputJsonRegister(void)
Definition: output-json.c:83
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:850
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:56
OutputJsonThreadCtx_
Definition: output-json.h:83
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
RootLogger_::LogFunc
OutputLogFunc LogFunc
Definition: output.c:88
output-json-dnp3.h
OutputRegisterFileRotationFlag
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:669
OutputJsonLogInitSub
OutputInitResult OutputJsonLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
Definition: output-json-common.c:82
LogHttpLogRegister
void LogHttpLogRegister(void)
Definition: log-httplog.c:65
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
Definition: output.c:472
OutputModule_::stream_type
enum SCOutputStreamingType stream_type
Definition: output.h:79
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:65
OutputRegisterTxModuleWithCondition
void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module with condition.
Definition: output.c:326
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
output_modules
OutputModuleList output_modules
JsonAnomalyLogRegister
void JsonAnomalyLogRegister(void)
Definition: output-json-anomaly.c:456
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
util-debug.h
output-json-flow.h
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
OutputStreamingLoggerRegister
void OutputStreamingLoggerRegister(void)
Definition: output-streaming.c:432
util-error.h
OutputRegisterStatsModule
void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a stats data output module.
Definition: output.c:547
log-tcp-data.h
g_alproto_max
AppProto g_alproto_max
Definition: app-layer-protos.c:29
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:66
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:50
output-json.h
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
OutputRegisterTxModuleWithProgress
void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module with progress.
Definition: output.c:350
output-json-file.h
OutputRegisterModule
void OutputRegisterModule(const char *, const char *, OutputInitFunc)
JsonIKELogRegister
void JsonIKELogRegister(void)
Definition: output-json-ike.c:182
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:39
OutputModule_::StreamingLogFunc
SCStreamingLogger StreamingLogFunc
Definition: output.h:76
log-tlslog.h
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
Definition: output.c:751
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-eve-bindgen.h:33
app-layer-parser.h
JsonMQTTLogRegister
void JsonMQTTLogRegister(void)
Definition: output-json-mqtt.c:192
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
OutputFilestoreRegister
void OutputFilestoreRegister(void)
Definition: output-filestore.c:503
OutputFlushFunc
TmEcode(* OutputFlushFunc)(ThreadVars *, Packet *, void *)
Definition: output.h:54
OutputRegisterLoggers
void OutputRegisterLoggers(void)
Register all non-root logging modules.
Definition: output.c:1026
OutputModule_::conf_name
const char * conf_name
Definition: output.h:60
output-json-anomaly.h
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:75
OutputDeregisterAll
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
Definition: output.c:635
Packet_
Definition: decode.h:484
RootLogger_::ActiveCntFunc
OutputGetActiveCountFunc ActiveCntFunc
Definition: output.c:92
OutputPacketLoggerRegister
void OutputPacketLoggerRegister(void)
Definition: output-packet.c:194
EveJsonTxLoggerRegistrationData
Definition: output-eve-bindgen.h:47
output-eve-bindgen.h
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:68
conf.h
OutputNotifyFileRotation
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
Definition: output.c:712
TAILQ_HEAD
typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_)
Definition: output.c:113
TmEcode
TmEcode
Definition: tm-threads-common.h:80
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:66
name
const char * name
Definition: tm-threads.c:2135
EveStreamLogRegister
void EveStreamLogRegister(void)
Definition: output-eve-stream.c:453
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:54
RootLogger_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.c:90
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
EveJsonSimpleAppLayerLogger
Definition: output-eve-bindgen.h:40
TAILQ_FOREACH_SAFE
#define TAILQ_FOREACH_SAFE(var, head, field, tvar)
Definition: queue.h:329
log-pcap.h
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
alert-fastlog.h
TxLoggerCondition
bool(* TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id)
Transaction logger condition function pointer type.
Definition: output-tx.h:41
LogStatsLogRegister
void LogStatsLogRegister(void)
Definition: log-stats.c:285
OutputPacketLoggerFunctions_::ThreadDeinitFunc
ThreadDeinitFunc ThreadDeinitFunc
Definition: output.h:92
JsonFrameLogRegister
void JsonFrameLogRegister(void)
Definition: output-json-frame.c:561
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
Packet_::flow
struct Flow_ * flow
Definition: decode.h:529
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:72
suricata-common.h
output-json-stats.h
EveJsonSimpleAppLayerLogger::LogTx
EveJsonSimpleTxLogFunc LogTx
Definition: output-eve-bindgen.h:41
ARRAY_CAP_STEP
#define ARRAY_CAP_STEP
Definition: output.c:988
output-json-nfs.h
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:62
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
OutputPacketLoggerFunctions_::LogFunc
PacketLogger LogFunc
Definition: output.h:88
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, OutputPacketLoggerFunctions *output_module_functions)
Register a packet output module.
Definition: output.c:173
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:53
output-filestore.h
FatalError
#define FatalError(...)
Definition: util-debug.h:502
LuaLogRegister
void LuaLogRegister(void)
Definition: output-lua.c:917
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition: app-layer-protos.h:64
OutputRegisterPacketSubModule
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, OutputPacketLoggerFunctions *output_logger_functions)
Register a packet output sub-module.
Definition: output.c:211
JsonSmtpLogRegister
void JsonSmtpLogRegister(void)
Definition: output-json-smtp.c:192
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
log-httplog.h
JsonMetadataLogRegister
void JsonMetadataLogRegister(void)
Definition: output-json-metadata.c:95
output-json-alert.h
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:70
RootLogger
struct RootLogger_ RootLogger
output-json-dns.h
OutputGetActiveCountFunc
uint32_t(* OutputGetActiveCountFunc)(void)
Definition: output.h:55
OutputPacketLoggerFunctions_::ThreadInitFunc
ThreadInitFunc ThreadInitFunc
Definition: output.h:91
log-cf-common.h
output-json-metadata.h
LOGGER_JSON_TX
@ LOGGER_JSON_TX
Definition: suricata-common.h:477
EveJsonSimpleAppLayerLogger::name
const char * name
Definition: output-eve-bindgen.h:42
JsonDnsLogRegister
void JsonDnsLogRegister(void)
Definition: output-json-dns.c:670
EveFTPLogCommand
bool EveFTPLogCommand(void *vtx, SCJsonBuilder *jb)
Definition: output-json-ftp.c:49
SCConfGetNode
SCConfNode * SCConfGetNode(const char *name)
Get a SCConfNode by name.
Definition: conf.c:181
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:737
SCFree
#define SCFree(p)
Definition: util-mem.h:61
output-json-dhcp.h
OutputLoggerFlush
TmEcode OutputLoggerFlush(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:722
JsonDropLogRegister
void JsonDropLogRegister(void)
Definition: output-json-drop.c:391
output-json-ike.h
StatsLogger
int(* StatsLogger)(ThreadVars *, void *thread_data, const StatsTable *)
Definition: output-stats.h:50
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:71
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:61
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:80
AlertJsonDnp3
bool AlertJsonDnp3(void *vtx, SCJsonBuilder *js)
Definition: output-json-dnp3.c:213
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:67
output-lua.h
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:60
LOG_DIR_PACKET
@ LOG_DIR_PACKET
Definition: output-eve-bindgen.h:32
JsonHttpLogRegister
void JsonHttpLogRegister(void)
Definition: output-json-http.c:644
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:70
output-json-smb.h
JsonArpLogRegister
void JsonArpLogRegister(void)
Definition: output-json-arp.c:104
id
uint32_t id
Definition: detect-flowbits.c:933
SCOutputStreamingType
SCOutputStreamingType
Definition: output-streaming.h:35
output-json-smtp.h
JsonLogThreadDeinit
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
Definition: output-json-common.c:132
output-json-http.h
flow.h
OutputModule_
Definition: output.h:57
AlertDebugLogRegister
void AlertDebugLogRegister(void)
Definition: alert-debuglog.c:481
OutputUnregisterFileRotationFlag
void OutputUnregisterFileRotationFlag(int *flag)
Unregister a file rotation flag.
Definition: output.c:692
OutputRegisterTxSubModuleWithCondition
void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:334
log-tlsstore.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
EveJsonSimpleTxLogFunc
bool(* EveJsonSimpleTxLogFunc)(const void *, void *)
Definition: output-eve-bindgen.h:38
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
OutputFiledataLoggerRegister
void OutputFiledataLoggerRegister(void)
Definition: output-filedata.c:269
AlertJsonDoh2
bool AlertJsonDoh2(void *txptr, SCJsonBuilder *js)
Definition: output-json-dns.c:257
OutputPacketLoggerFunctions_
Definition: output.h:87
SCMutex
#define SCMutex
Definition: threads-debug.h:114
OutputInitSubFunc
OutputInitResult(* OutputInitSubFunc)(SCConfNode *, OutputCtx *)
Definition: output.h:52
SCStreamingLogger
int(* SCStreamingLogger)(ThreadVars *, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags)
Definition: output-streaming.h:41
output.h
JsonAlertLogRegister
void JsonAlertLogRegister(void)
Definition: output-json-alert.c:1094
JsonNFSLogRegister
void JsonNFSLogRegister(void)
Definition: output-json-nfs.c:109
OutputDropLoggerDisable
void OutputDropLoggerDisable(void)
Definition: output.c:657
JsonNetFlowLogRegister
void JsonNetFlowLogRegister(void)
Definition: output-json-netflow.c:308
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:40
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:62
RootLogger_
Definition: output.c:87
output-json-drop.h