suricata
output.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author OISF, Jason Ish <jason.ish@oisf.net>
22  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
23  *
24  * The root logging output for all non-application logging.
25  *
26  * The loggers are made up of a hierarchy of loggers. At the top we
27  * have the root logger which is the main entry point to
28  * logging. Under the root there exists parent loggers that are the
29  * entry point for specific types of loggers such as packet logger,
30  * transaction loggers, etc. Each parent logger may have 0 or more
31  * loggers that actual handle the job of producing output to something
32  * like a file.
33  */
34 
35 #include "suricata-common.h"
36 #include "flow.h"
37 #include "conf.h"
38 #include "tm-threads.h"
39 #include "util-error.h"
40 #include "util-debug.h"
41 #include "output.h"
42 
43 #include "alert-fastlog.h"
44 #include "alert-debuglog.h"
45 #include "alert-syslog.h"
46 #include "output-json.h"
47 #include "output-json-alert.h"
48 #include "output-json-anomaly.h"
49 #include "output-json-flow.h"
50 #include "output-json-netflow.h"
51 #include "log-cf-common.h"
52 #include "output-json-drop.h"
53 #include "output-eve-stream.h"
54 #include "log-httplog.h"
55 #include "output-json-http.h"
56 #include "output-json-dns.h"
57 #include "log-tlslog.h"
58 #include "log-tlsstore.h"
59 #include "output-json-tls.h"
60 #include "log-pcap.h"
61 // for SSHTxLogCondition
62 #include "app-layer-ssh.h"
63 #include "output-json-file.h"
64 #include "output-json-smtp.h"
65 #include "output-json-stats.h"
66 #include "log-tcp-data.h"
67 #include "log-stats.h"
68 #include "output-json-nfs.h"
69 #include "output-json-ftp.h"
70 // for misplaced EveFTPDataAddMetadata
71 #include "app-layer-ftp.h"
72 #include "output-json-smb.h"
73 #include "output-json-ike.h"
74 #include "output-json-dhcp.h"
75 #include "output-json-mqtt.h"
76 #include "output-json-pgsql.h"
77 #include "output-lua.h"
78 #include "output-json-dnp3.h"
79 #include "output-json-metadata.h"
80 #include "output-json-dcerpc.h"
81 #include "output-json-frame.h"
82 #include "app-layer-parser.h"
83 #include "output-filestore.h"
84 #include "output-json-arp.h"
85 
86 typedef struct RootLogger_ {
91 
92  TAILQ_ENTRY(RootLogger_) entries;
94 
95 /* List of registered root loggers. These are registered at start up and
96  * are independent of configuration. Later we will build a list of active
97  * loggers based on configuration. */
98 static TAILQ_HEAD(, RootLogger_) registered_loggers =
99  TAILQ_HEAD_INITIALIZER(registered_loggers);
100 
101 /* List of active root loggers. This means that at least one logger is enabled
102  * for each root logger type in the config. */
103 static TAILQ_HEAD(, RootLogger_) active_loggers =
104  TAILQ_HEAD_INITIALIZER(active_loggers);
105 
106 typedef struct LoggerThreadStoreNode_ {
107  void *thread_data;
108  TAILQ_ENTRY(LoggerThreadStoreNode_) entries;
110 
111 typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_) LoggerThreadStore;
112 
113 /**
114  * The list of all registered (known) output modules.
115  */
117 
118 /**
119  * Registry of flags to be updated on file rotation notification.
120  */
121 typedef struct OutputFileRolloverFlag_ {
122  int *flag;
123 
124  TAILQ_ENTRY(OutputFileRolloverFlag_) entries;
126 
127 TAILQ_HEAD(, OutputFileRolloverFlag_) output_file_rotation_flags =
128  TAILQ_HEAD_INITIALIZER(output_file_rotation_flags);
129 
130 void OutputRegisterRootLoggers(void);
131 void OutputRegisterLoggers(void);
132 
133 /**
134  * \brief Register an output module.
135  *
136  * This function will register an output module so it can be
137  * configured with the configuration file.
138  *
139  * \retval Returns 0 on success, -1 on failure.
140  */
141 void OutputRegisterModule(const char *name, const char *conf_name,
142  OutputInitFunc InitFunc)
143 {
144  OutputModule *module = SCCalloc(1, sizeof(*module));
145  if (unlikely(module == NULL))
146  goto error;
147 
148  module->name = name;
149  module->conf_name = conf_name;
150  module->InitFunc = InitFunc;
151  TAILQ_INSERT_TAIL(&output_modules, module, entries);
152 
153  SCLogDebug("Output module \"%s\" registered.", name);
154 
155  return;
156 
157 error:
158  FatalError("Fatal error encountered in OutputRegisterModule. Exiting...");
159 }
160 
161 /**
162  * \brief Register a packet output module.
163  *
164  * This function will register an output module so it can be
165  * configured with the configuration file.
166  *
167  * \retval Returns 0 on success, -1 on failure.
168  */
169 void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name,
170  OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc,
171  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
172 {
173  if (unlikely(PacketLogFunc == NULL || PacketConditionFunc == NULL)) {
174  goto error;
175  }
176 
177  OutputModule *module = SCCalloc(1, sizeof(*module));
178  if (unlikely(module == NULL)) {
179  goto error;
180  }
181 
182  module->logger_id = id;
183  module->name = name;
184  module->conf_name = conf_name;
185  module->InitFunc = InitFunc;
186  module->PacketLogFunc = PacketLogFunc;
187  module->PacketConditionFunc = PacketConditionFunc;
188  module->ThreadInit = ThreadInit;
189  module->ThreadDeinit = ThreadDeinit;
190  TAILQ_INSERT_TAIL(&output_modules, module, entries);
191 
192  SCLogDebug("Packet logger \"%s\" registered.", name);
193  return;
194 error:
195  FatalError("Fatal error encountered. Exiting...");
196 }
197 
198 /**
199  * \brief Register a packet output sub-module.
200  *
201  * This function will register an output module so it can be
202  * configured with the configuration file.
203  *
204  * \retval Returns 0 on success, -1 on failure.
205  */
206 void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name,
207  const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc,
208  PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit,
209  ThreadDeinitFunc ThreadDeinit)
210 {
211  if (unlikely(PacketLogFunc == NULL || PacketConditionFunc == NULL)) {
212  goto error;
213  }
214 
215  OutputModule *module = SCCalloc(1, sizeof(*module));
216  if (unlikely(module == NULL)) {
217  goto error;
218  }
219 
220  module->logger_id = id;
221  module->name = name;
222  module->conf_name = conf_name;
223  module->parent_name = parent_name;
224  module->InitSubFunc = InitFunc;
225  module->PacketLogFunc = PacketLogFunc;
226  module->PacketConditionFunc = PacketConditionFunc;
227  module->ThreadInit = ThreadInit;
228  module->ThreadDeinit = ThreadDeinit;
229  TAILQ_INSERT_TAIL(&output_modules, module, entries);
230 
231  SCLogDebug("Packet logger \"%s\" registered.", name);
232  return;
233 error:
234  FatalError("Fatal error encountered. Exiting...");
235 }
236 
237 /**
238  * \brief Wrapper function for tx output modules.
239  *
240  * This function will register an output module so it can be
241  * configured with the configuration file.
242  *
243  * \retval Returns 0 on success, -1 on failure.
244  */
245 static void OutputRegisterTxModuleWrapper(LoggerId id, const char *name, const char *conf_name,
246  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress,
247  int ts_log_progress, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit,
248  ThreadDeinitFunc ThreadDeinit)
249 {
250  if (unlikely(TxLogFunc == NULL)) {
251  goto error;
252  }
253 
254  OutputModule *module = SCCalloc(1, sizeof(*module));
255  if (unlikely(module == NULL)) {
256  goto error;
257  }
258 
259  module->logger_id = id;
260  module->name = name;
261  module->conf_name = conf_name;
262  module->InitFunc = InitFunc;
263  module->TxLogFunc = TxLogFunc;
264  module->TxLogCondition = TxLogCondition;
265  module->alproto = alproto;
266  module->tc_log_progress = tc_log_progress;
267  module->ts_log_progress = ts_log_progress;
268  module->ThreadInit = ThreadInit;
269  module->ThreadDeinit = ThreadDeinit;
270  TAILQ_INSERT_TAIL(&output_modules, module, entries);
271 
272  SCLogDebug("Tx logger \"%s\" registered.", name);
273  return;
274 error:
275  FatalError("Fatal error encountered. Exiting...");
276 }
277 
278 static void OutputRegisterTxSubModuleWrapper(LoggerId id, const char *parent_name, const char *name,
279  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
280  int tc_log_progress, int ts_log_progress, TxLoggerCondition TxLogCondition,
281  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
282 {
283  if (unlikely(TxLogFunc == NULL)) {
284  goto error;
285  }
286 
287  OutputModule *module = SCCalloc(1, sizeof(*module));
288  if (unlikely(module == NULL)) {
289  goto error;
290  }
291 
292  module->logger_id = id;
293  module->name = name;
294  module->conf_name = conf_name;
295  module->parent_name = parent_name;
296  module->InitSubFunc = InitFunc;
297  module->TxLogFunc = TxLogFunc;
298  module->TxLogCondition = TxLogCondition;
299  module->alproto = alproto;
300  module->tc_log_progress = tc_log_progress;
301  module->ts_log_progress = ts_log_progress;
302  module->ThreadInit = ThreadInit;
303  module->ThreadDeinit = ThreadDeinit;
304  TAILQ_INSERT_TAIL(&output_modules, module, entries);
305 
306  SCLogDebug("Tx logger for alproto %d \"%s\" registered.", alproto, name);
307  return;
308 error:
309  FatalError("Fatal error encountered. Exiting...");
310 }
311 
312 /**
313  * \brief Register a tx output module with condition.
314  *
315  * This function will register an output module so it can be
316  * configured with the configuration file.
317  *
318  * \retval Returns 0 on success, -1 on failure.
319  */
320 void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name,
321  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
322  TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
323 {
324  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1,
325  TxLogCondition, ThreadInit, ThreadDeinit);
326 }
327 
328 void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name,
329  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
330  TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
331 {
332  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
333  -1, -1, TxLogCondition, ThreadInit, ThreadDeinit);
334 }
335 
336 /**
337  * \brief Register a tx output module with progress.
338  *
339  * This function will register an output module so it can be
340  * configured with the configuration file.
341  *
342  * \retval Returns 0 on success, -1 on failure.
343  */
344 void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name,
345  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress,
346  int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
347 {
348  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc,
349  tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit);
350 }
351 
352 void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name,
353  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
354  int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit,
355  ThreadDeinitFunc ThreadDeinit)
356 {
357  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
358  tc_log_progress, ts_log_progress, NULL, ThreadInit, ThreadDeinit);
359 }
360 
361 /**
362  * \brief Register a tx output module.
363  *
364  * This function will register an output module so it can be
365  * configured with the configuration file.
366  *
367  * \retval Returns 0 on success, -1 on failure.
368  */
369 void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name,
370  OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit,
371  ThreadDeinitFunc ThreadDeinit)
372 {
373  OutputRegisterTxModuleWrapper(id, name, conf_name, InitFunc, alproto, TxLogFunc, -1, -1, NULL,
374  ThreadInit, ThreadDeinit);
375 }
376 
377 void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name,
378  const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
379  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
380 {
381  OutputRegisterTxSubModuleWrapper(id, parent_name, name, conf_name, InitFunc, alproto, TxLogFunc,
382  -1, -1, NULL, ThreadInit, ThreadDeinit);
383 }
384 
385 /**
386  * \brief Register a file output sub-module.
387  *
388  * This function will register an output module so it can be
389  * configured with the configuration file.
390  *
391  * \retval Returns 0 on success, -1 on failure.
392  */
393 void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name,
394  const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc,
395  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
396 {
397  if (unlikely(FileLogFunc == NULL)) {
398  goto error;
399  }
400 
401  OutputModule *module = SCCalloc(1, sizeof(*module));
402  if (unlikely(module == NULL)) {
403  goto error;
404  }
405 
406  module->logger_id = id;
407  module->name = name;
408  module->conf_name = conf_name;
409  module->parent_name = parent_name;
410  module->InitSubFunc = InitFunc;
411  module->FileLogFunc = FileLogFunc;
412  module->ThreadInit = ThreadInit;
413  module->ThreadDeinit = ThreadDeinit;
414  TAILQ_INSERT_TAIL(&output_modules, module, entries);
415 
416  SCLogDebug("File logger \"%s\" registered.", name);
417  return;
418 error:
419  FatalError("Fatal error encountered. Exiting...");
420 }
421 
422 /**
423  * \brief Register a file data output module.
424  *
425  * This function will register an output module so it can be
426  * configured with the configuration file.
427  *
428  * \retval Returns 0 on success, -1 on failure.
429  */
430 void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name,
431  OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit,
432  ThreadDeinitFunc ThreadDeinit)
433 {
434  if (unlikely(FiledataLogFunc == NULL)) {
435  goto error;
436  }
437 
438  OutputModule *module = SCCalloc(1, sizeof(*module));
439  if (unlikely(module == NULL)) {
440  goto error;
441  }
442 
443  module->logger_id = id;
444  module->name = name;
445  module->conf_name = conf_name;
446  module->InitFunc = InitFunc;
447  module->FiledataLogFunc = FiledataLogFunc;
448  module->ThreadInit = ThreadInit;
449  module->ThreadDeinit = ThreadDeinit;
450  TAILQ_INSERT_TAIL(&output_modules, module, entries);
451 
452  SCLogDebug("Filedata logger \"%s\" registered.", name);
453  return;
454 error:
455  FatalError("Fatal error encountered. Exiting...");
456 }
457 
458 /**
459  * \brief Register a flow output sub-module.
460  *
461  * This function will register an output module so it can be
462  * configured with the configuration file.
463  *
464  * \retval Returns 0 on success, -1 on failure.
465  */
466 void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name,
467  const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc,
468  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
469 {
470  if (unlikely(FlowLogFunc == NULL)) {
471  goto error;
472  }
473 
474  OutputModule *module = SCCalloc(1, sizeof(*module));
475  if (unlikely(module == NULL)) {
476  goto error;
477  }
478 
479  module->logger_id = id;
480  module->name = name;
481  module->conf_name = conf_name;
482  module->parent_name = parent_name;
483  module->InitSubFunc = InitFunc;
484  module->FlowLogFunc = FlowLogFunc;
485  module->ThreadInit = ThreadInit;
486  module->ThreadDeinit = ThreadDeinit;
487  TAILQ_INSERT_TAIL(&output_modules, module, entries);
488 
489  SCLogDebug("Flow logger \"%s\" registered.", name);
490  return;
491 error:
492  FatalError("Fatal error encountered. Exiting...");
493 }
494 
495 /**
496  * \brief Register a streaming data output module.
497  *
498  * This function will register an output module so it can be
499  * configured with the configuration file.
500  *
501  * \retval Returns 0 on success, -1 on failure.
502  */
503 void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name,
504  OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc,
505  enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit,
506  ThreadDeinitFunc ThreadDeinit)
507 {
508  if (unlikely(StreamingLogFunc == NULL)) {
509  goto error;
510  }
511 
512  OutputModule *module = SCCalloc(1, sizeof(*module));
513  if (unlikely(module == NULL)) {
514  goto error;
515  }
516 
517  module->logger_id = id;
518  module->name = name;
519  module->conf_name = conf_name;
520  module->InitFunc = InitFunc;
521  module->StreamingLogFunc = StreamingLogFunc;
522  module->stream_type = stream_type;
523  module->ThreadInit = ThreadInit;
524  module->ThreadDeinit = ThreadDeinit;
525  TAILQ_INSERT_TAIL(&output_modules, module, entries);
526 
527  SCLogDebug("Streaming logger \"%s\" registered.", name);
528  return;
529 error:
530  FatalError("Fatal error encountered. Exiting...");
531 }
532 
533 /**
534  * \brief Register a stats data output module.
535  *
536  * This function will register an output module so it can be
537  * configured with the configuration file.
538  *
539  * \retval Returns 0 on success, -1 on failure.
540  */
541 void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name,
542  OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit,
543  ThreadDeinitFunc ThreadDeinit)
544 {
545  if (unlikely(StatsLogFunc == NULL)) {
546  goto error;
547  }
548 
549  OutputModule *module = SCCalloc(1, sizeof(*module));
550  if (unlikely(module == NULL)) {
551  goto error;
552  }
553 
554  module->logger_id = id;
555  module->name = name;
556  module->conf_name = conf_name;
557  module->InitFunc = InitFunc;
558  module->StatsLogFunc = StatsLogFunc;
559  module->ThreadInit = ThreadInit;
560  module->ThreadDeinit = ThreadDeinit;
561  TAILQ_INSERT_TAIL(&output_modules, module, entries);
562 
563  SCLogDebug("Stats logger \"%s\" registered.", name);
564  return;
565 error:
566  FatalError("Fatal error encountered. Exiting...");
567 }
568 
569 /**
570  * \brief Register a stats data output sub-module.
571  *
572  * This function will register an output module so it can be
573  * configured with the configuration file.
574  *
575  * \retval Returns 0 on success, -1 on failure.
576  */
577 void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name,
578  const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc,
579  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
580 {
581  if (unlikely(StatsLogFunc == NULL)) {
582  goto error;
583  }
584 
585  OutputModule *module = SCCalloc(1, sizeof(*module));
586  if (unlikely(module == NULL)) {
587  goto error;
588  }
589 
590  module->logger_id = id;
591  module->name = name;
592  module->conf_name = conf_name;
593  module->parent_name = parent_name;
594  module->InitSubFunc = InitFunc;
595  module->StatsLogFunc = StatsLogFunc;
596  module->ThreadInit = ThreadInit;
597  module->ThreadDeinit = ThreadDeinit;
598  TAILQ_INSERT_TAIL(&output_modules, module, entries);
599 
600  SCLogDebug("Stats logger \"%s\" registered.", name);
601  return;
602 error:
603  FatalError("Fatal error encountered. Exiting...");
604 }
605 
606 /**
607  * \brief Get an output module by name.
608  *
609  * \retval The OutputModule with the given name or NULL if no output module
610  * with the given name is registered.
611  */
613 {
614  OutputModule *module;
615 
616  TAILQ_FOREACH(module, &output_modules, entries) {
617  if (strcmp(module->conf_name, conf_name) == 0)
618  return module;
619  }
620 
621  return NULL;
622 }
623 
624 static EveJsonSimpleAppLayerLogger *simple_json_applayer_loggers;
625 
626 /**
627  * \brief Deregister all modules. Useful for a memory clean exit.
628  */
630 {
631  OutputModule *module;
632 
633  while ((module = TAILQ_FIRST(&output_modules))) {
634  TAILQ_REMOVE(&output_modules, module, entries);
635  SCFree(module);
636  }
637  SCFree(simple_json_applayer_loggers);
638  simple_json_applayer_loggers = NULL;
639 }
640 
641 static int drop_loggers = 0;
642 
644 {
645  if (drop_loggers)
646  return -1;
647  drop_loggers++;
648  return 0;
649 }
650 
652 {
653  if (drop_loggers)
654  drop_loggers--;
655 }
656 
657 /**
658  * \brief Register a flag for file rotation notification.
659  *
660  * \param flag A pointer that will be set to 1 when file rotation is
661  * requested.
662  */
664 {
665  OutputFileRolloverFlag *flag_entry = SCCalloc(1, sizeof(*flag_entry));
666  if (unlikely(flag_entry == NULL)) {
667  SCLogError("Failed to allocate memory to register file rotation flag");
668  return;
669  }
670  flag_entry->flag = flag;
671  TAILQ_INSERT_TAIL(&output_file_rotation_flags, flag_entry, entries);
672 }
673 
674 /**
675  * \brief Unregister a file rotation flag.
676  *
677  * Note that it is safe to call this function with a flag that may not
678  * have been registered, in which case this function won't do
679  * anything.
680  *
681  * \param flag A pointer that has been previously registered for file
682  * rotation notifications.
683  */
685 {
686  OutputFileRolloverFlag *entry, *next;
687  for (entry = TAILQ_FIRST(&output_file_rotation_flags); entry != NULL;
688  entry = next) {
689  next = TAILQ_NEXT(entry, entries);
690  if (entry->flag == flag) {
691  TAILQ_REMOVE(&output_file_rotation_flags, entry, entries);
692  SCFree(entry);
693  break;
694  }
695  }
696 }
697 
698 /**
699  * \brief Notifies all registered file rotation notification flags.
700  */
703  TAILQ_FOREACH(flag, &output_file_rotation_flags, entries) {
704  *(flag->flag) = 1;
705  }
706 }
707 
708 TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
709 {
710  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
711  RootLogger *logger = TAILQ_FIRST(&active_loggers);
712  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
713  while (logger && thread_store_node) {
714  logger->LogFunc(tv, p, thread_store_node->thread_data);
715 
716  logger = TAILQ_NEXT(logger, entries);
717  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
718  }
719  return TM_ECODE_OK;
720 }
721 
722 TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
723 {
724  LoggerThreadStore *thread_store = SCCalloc(1, sizeof(*thread_store));
725  if (thread_store == NULL) {
726  return TM_ECODE_FAILED;
727  }
728  TAILQ_INIT(thread_store);
729  *data = (void *)thread_store;
730 
731  RootLogger *logger;
732  TAILQ_FOREACH(logger, &active_loggers, entries) {
733 
734  void *child_thread_data = NULL;
735  if (logger->ThreadInit != NULL) {
736  if (logger->ThreadInit(tv, initdata, &child_thread_data) == TM_ECODE_OK) {
737  LoggerThreadStoreNode *thread_store_node =
738  SCCalloc(1, sizeof(*thread_store_node));
739  if (thread_store_node == NULL) {
740  /* Undo everything, calling de-init will take care
741  * of that. */
742  OutputLoggerThreadDeinit(tv, thread_store);
743  return TM_ECODE_FAILED;
744  }
745  thread_store_node->thread_data = child_thread_data;
746  TAILQ_INSERT_TAIL(thread_store, thread_store_node, entries);
747  }
748  }
749  }
750  return TM_ECODE_OK;
751 }
752 
754 {
755  if (thread_data == NULL)
756  return TM_ECODE_FAILED;
757 
758  LoggerThreadStore *thread_store = (LoggerThreadStore *)thread_data;
759  RootLogger *logger = TAILQ_FIRST(&active_loggers);
760  LoggerThreadStoreNode *thread_store_node = TAILQ_FIRST(thread_store);
761  while (logger && thread_store_node) {
762  if (logger->ThreadDeinit != NULL) {
763  logger->ThreadDeinit(tv, thread_store_node->thread_data);
764  }
765  logger = TAILQ_NEXT(logger, entries);
766  thread_store_node = TAILQ_NEXT(thread_store_node, entries);
767  }
768 
769  /* Free the thread store. */
770  while ((thread_store_node = TAILQ_FIRST(thread_store)) != NULL) {
771  TAILQ_REMOVE(thread_store, thread_store_node, entries);
772  SCFree(thread_store_node);
773  }
774  SCFree(thread_store);
775 
776  return TM_ECODE_OK;
777 }
778 
780  OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
781 {
782  BUG_ON(LogFunc == NULL);
783 
784  RootLogger *logger = SCCalloc(1, sizeof(*logger));
785  if (logger == NULL) {
786  FatalError("failed to alloc root logger");
787  }
788  logger->ThreadInit = ThreadInit;
789  logger->ThreadDeinit = ThreadDeinit;
790  logger->LogFunc = LogFunc;
791  logger->ActiveCntFunc = ActiveCntFunc;
792  TAILQ_INSERT_TAIL(&registered_loggers, logger, entries);
793 }
794 
795 static void OutputRegisterActiveLogger(RootLogger *reg)
796 {
797  RootLogger *logger = SCCalloc(1, sizeof(*logger));
798  if (logger == NULL) {
799  FatalError("failed to alloc root logger");
800  }
801  logger->ThreadInit = reg->ThreadInit;
802  logger->ThreadDeinit = reg->ThreadDeinit;
803  logger->LogFunc = reg->LogFunc;
804  logger->ActiveCntFunc = reg->ActiveCntFunc;
805  TAILQ_INSERT_TAIL(&active_loggers, logger, entries);
806 }
807 
809 {
810  RootLogger *logger = TAILQ_FIRST(&registered_loggers);
811  while (logger) {
812  uint32_t cnt = logger->ActiveCntFunc();
813  if (cnt) {
814  OutputRegisterActiveLogger(logger);
815  }
816 
817  logger = TAILQ_NEXT(logger, entries);
818  }
819 }
820 
822 {
823  RootLogger *logger;
824  while ((logger = TAILQ_FIRST(&active_loggers)) != NULL) {
825  TAILQ_REMOVE(&active_loggers, logger, entries);
826  SCFree(logger);
827  }
828 }
829 
831 {
834 }
835 
837 {
838  if (alproto < ALPROTO_MAX) {
839  return &simple_json_applayer_loggers[alproto];
840  }
841  return NULL;
842 }
843 
844 static void RegisterSimpleJsonApplayerLogger(
845  AppProto alproto, EveJsonSimpleTxLogFunc LogTx, const char *name)
846 {
847  simple_json_applayer_loggers[alproto].LogTx = LogTx;
848  if (name) {
849  simple_json_applayer_loggers[alproto].name = name;
850  } else {
851  simple_json_applayer_loggers[alproto].name = AppProtoToString(alproto);
852  }
853 }
854 
855 /**
856  * \brief Register all root loggers.
857  */
859 {
860  simple_json_applayer_loggers = SCCalloc(ALPROTO_MAX, sizeof(EveJsonSimpleAppLayerLogger));
861  if (unlikely(simple_json_applayer_loggers == NULL)) {
862  FatalError("Failed to allocate simple_json_applayer_loggers");
863  }
864  // ALPROTO_HTTP1 special: uses some options flags
865  RegisterSimpleJsonApplayerLogger(ALPROTO_FTP, EveFTPLogCommand, NULL);
866  // ALPROTO_SMTP special: uses state
867  RegisterSimpleJsonApplayerLogger(ALPROTO_TLS, JsonTlsLogJSONExtended, NULL);
868  // no cast here but done in rust for SSHTransaction
869  RegisterSimpleJsonApplayerLogger(ALPROTO_SSH, rs_ssh_log_json, NULL);
870  // ALPROTO_SMB special: uses state
871  // ALPROTO_DCERPC special: uses state
872  RegisterSimpleJsonApplayerLogger(ALPROTO_DNS, AlertJsonDns, NULL);
873  // either need a cast here or in rust for ModbusTransaction, done here
874  RegisterSimpleJsonApplayerLogger(
875  ALPROTO_MODBUS, (EveJsonSimpleTxLogFunc)rs_modbus_to_json, NULL);
876  RegisterSimpleJsonApplayerLogger(ALPROTO_ENIP, SCEnipLoggerLog, NULL);
877  RegisterSimpleJsonApplayerLogger(ALPROTO_DNP3, AlertJsonDnp3, NULL);
878  // ALPROTO_NFS special: uses state
879  // underscore instead of dash for ftp_data
880  RegisterSimpleJsonApplayerLogger(ALPROTO_FTPDATA, EveFTPDataAddMetadata, "ftp_data");
881  RegisterSimpleJsonApplayerLogger(
882  ALPROTO_TFTP, (EveJsonSimpleTxLogFunc)rs_tftp_log_json_request, NULL);
883  // ALPROTO_IKE special: uses state
884  RegisterSimpleJsonApplayerLogger(
885  ALPROTO_KRB5, (EveJsonSimpleTxLogFunc)rs_krb5_log_json_response, NULL);
886  RegisterSimpleJsonApplayerLogger(ALPROTO_QUIC, rs_quic_to_json, NULL);
887  // ALPROTO_DHCP TODO missing
888  RegisterSimpleJsonApplayerLogger(
889  ALPROTO_SNMP, (EveJsonSimpleTxLogFunc)rs_snmp_log_json_response, NULL);
890  RegisterSimpleJsonApplayerLogger(ALPROTO_SIP, (EveJsonSimpleTxLogFunc)rs_sip_log_json, NULL);
891  RegisterSimpleJsonApplayerLogger(ALPROTO_RFB, rs_rfb_logger_log, NULL);
892  RegisterSimpleJsonApplayerLogger(ALPROTO_MQTT, JsonMQTTAddMetadata, NULL);
893  RegisterSimpleJsonApplayerLogger(ALPROTO_PGSQL, JsonPgsqlAddMetadata, NULL);
894  RegisterSimpleJsonApplayerLogger(ALPROTO_WEBSOCKET, rs_websocket_logger_log, NULL);
895  RegisterSimpleJsonApplayerLogger(ALPROTO_LDAP, rs_ldap_logger_log, NULL);
896  RegisterSimpleJsonApplayerLogger(ALPROTO_DOH2, AlertJsonDoh2, NULL);
897  RegisterSimpleJsonApplayerLogger(ALPROTO_TEMPLATE, rs_template_logger_log, NULL);
898  RegisterSimpleJsonApplayerLogger(ALPROTO_RDP, (EveJsonSimpleTxLogFunc)rs_rdp_to_json, NULL);
899  // special case : http2 is logged in http object
900  RegisterSimpleJsonApplayerLogger(ALPROTO_HTTP2, rs_http2_log_json, "http");
901  // underscore instead of dash for bittorrent_dht
902  RegisterSimpleJsonApplayerLogger(
903  ALPROTO_BITTORRENT_DHT, rs_bittorrent_dht_logger_log, "bittorrent_dht");
904 
910 }
911 
912 static int JsonGenericLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
913  void *state, void *tx, uint64_t tx_id, int dir)
914 {
915  OutputJsonThreadCtx *thread = thread_data;
917  if (al == NULL) {
918  return TM_ECODE_FAILED;
919  }
920 
921  JsonBuilder *js = CreateEveHeader(p, dir, al->name, NULL, thread->ctx);
922  if (unlikely(js == NULL)) {
923  return TM_ECODE_FAILED;
924  }
925 
926  if (!al->LogTx(tx, js)) {
927  goto error;
928  }
929 
930  OutputJsonBuilderBuffer(tv, p, p->flow, js, thread);
931  jb_free(js);
932 
933  return TM_ECODE_OK;
934 
935 error:
936  jb_free(js);
937  return TM_ECODE_FAILED;
938 }
939 
940 static int JsonGenericDirPacketLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
941  void *state, void *tx, uint64_t tx_id)
942 {
943  return JsonGenericLogger(tv, thread_data, p, f, state, tx, tx_id, LOG_DIR_PACKET);
944 }
945 
946 static int JsonGenericDirFlowLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f,
947  void *state, void *tx, uint64_t tx_id)
948 {
949  return JsonGenericLogger(tv, thread_data, p, f, state, tx, tx_id, LOG_DIR_FLOW);
950 }
951 
952 /**
953  * \brief Register all non-root logging modules.
954  */
956 {
957  /* custom format log*/
959 
960  LuaLogRegister();
961  /* fast log */
963  /* debug log */
965  /* syslog log */
969  /* json log */
971  /* email logs */
973  /* http log */
976  OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "LogHttp2Log", "eve-log.http2",
977  OutputJsonLogInitSub, ALPROTO_HTTP2, JsonGenericDirFlowLogger, HTTP2StateClosed,
978  HTTP2StateClosed, JsonLogThreadInit, JsonLogThreadDeinit);
979  /* tls log */
983  /* ssh */
984  OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_TX, "eve-log", "JsonSshLog", "eve-log.ssh",
985  OutputJsonLogInitSub, ALPROTO_SSH, JsonGenericDirFlowLogger, SSHTxLogCondition,
987  /* pcap log */
988  PcapLogRegister();
989  /* file log */
992  /* dns */
994  /* modbus */
995  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonModbusLog", "eve-log.modbus",
996  OutputJsonLogInitSub, ALPROTO_MODBUS, JsonGenericDirFlowLogger, JsonLogThreadInit,
998 
999  SCLogDebug("modbus json logger registered.");
1000  /* tcp streaming data */
1002  /* log stats */
1004 
1007  /* flow/netflow */
1010  /* json stats */
1012 
1013  /* DNP3. */
1016 
1017  /* NFS JSON logger. */
1019  /* TFTP JSON logger. */
1020  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTFTPLog", "eve-log.tftp",
1021  OutputJsonLogInitSub, ALPROTO_TFTP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1023 
1024  SCLogDebug("TFTP JSON logger registered.");
1025  /* FTP and FTP-DATA JSON loggers. */
1026  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
1027  OutputJsonLogInitSub, ALPROTO_FTP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1029  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
1030  OutputJsonLogInitSub, ALPROTO_FTPDATA, JsonGenericDirFlowLogger, JsonLogThreadInit,
1032  SCLogDebug("FTP JSON logger registered.");
1033 
1034  /* SMB JSON logger. */
1036  /* IKE JSON logger. */
1038  /* KRB5 JSON logger. */
1039  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonKRB5Log", "eve-log.krb5",
1040  OutputJsonLogInitSub, ALPROTO_KRB5, JsonGenericDirPacketLogger, JsonLogThreadInit,
1042 
1043  SCLogDebug("KRB5 JSON logger registered.");
1044  /* QUIC JSON logger. */
1045  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonQuicLog", "eve-log.quic",
1046  OutputJsonLogInitSub, ALPROTO_QUIC, JsonGenericDirPacketLogger, JsonLogThreadInit,
1048 
1049  SCLogDebug("quic json logger registered.");
1050  /* DHCP JSON logger. */
1052  /* SNMP JSON logger. */
1053  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSNMPLog", "eve-log.snmp",
1054  OutputJsonLogInitSub, ALPROTO_SNMP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1056 
1057  SCLogDebug("SNMP JSON logger registered.");
1058  /* SIP JSON logger. */
1059  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSIPLog", "eve-log.sip",
1060  OutputJsonLogInitSub, ALPROTO_SIP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1062 
1063  SCLogDebug("SIP JSON logger registered.");
1064  /* RFB JSON logger. */
1065  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRFBLog", "eve-log.rfb",
1066  OutputJsonLogInitSub, ALPROTO_RFB, JsonGenericDirPacketLogger, JsonLogThreadInit,
1068  /* MQTT JSON logger. */
1070  /* Pgsql JSON logger. */
1072  /* WebSocket JSON logger. */
1073  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonWebSocketLog", "eve-log.websocket",
1074  OutputJsonLogInitSub, ALPROTO_WEBSOCKET, JsonGenericDirPacketLogger, JsonLogThreadInit,
1076  /* Enip JSON logger. */
1077  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonEnipLog", "eve-log.enip",
1078  OutputJsonLogInitSub, ALPROTO_ENIP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1080  /* Ldap JSON logger. */
1081  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonLdapLog", "eve-log.ldap",
1082  OutputJsonLogInitSub, ALPROTO_LDAP, JsonGenericDirFlowLogger, JsonLogThreadInit,
1084  /* DoH2 JSON logger. */
1086  /* Template JSON logger. */
1087  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTemplateLog", "eve-log.template",
1088  OutputJsonLogInitSub, ALPROTO_TEMPLATE, JsonGenericDirPacketLogger, JsonLogThreadInit,
1090  /* RDP JSON logger. */
1091  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRdpLog", "eve-log.rdp",
1092  OutputJsonLogInitSub, ALPROTO_RDP, JsonGenericDirPacketLogger, JsonLogThreadInit,
1094  SCLogDebug("rdp json logger registered.");
1095  /* DCERPC JSON logger. */
1097  /* app layer frames */
1099  /* BitTorrent DHT JSON logger */
1100  if (ConfGetNode("app-layer.protocols.bittorrent-dht") != NULL) {
1101  /* Register as an eve sub-module. */
1102  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonBitTorrentDHTLog",
1103  "eve-log.bittorrent-dht", OutputJsonLogInitSub, ALPROTO_BITTORRENT_DHT,
1104  JsonGenericDirPacketLogger, JsonLogThreadInit, JsonLogThreadDeinit);
1105  }
1106  /* ARP JSON logger */
1108 }
RootLogger_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.c:89
log-stats.h
OutputModule_::parent_name
const char * parent_name
Definition: output.h:60
OutputFileRolloverFlag
OutputFileRolloverFlag
Definition: output.c:125
LogTlsStoreRegister
void LogTlsStoreRegister(void)
Definition: log-tlsstore.c:436
tm-threads.h
OutputModule_::FileLogFunc
SCFileLogger FileLogFunc
Definition: output.h:71
output-json-ftp.h
OutputJsonLogInitSub
OutputInitResult OutputJsonLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
Definition: output-json-common.c:73
OutputDropLoggerEnable
int OutputDropLoggerEnable(void)
Definition: output.c:643
OutputRegisterStreamingModule
void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCStreamingLogger StreamingLogFunc, enum SCOutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a streaming data output module.
Definition: output.c:503
LoggerThreadStoreNode
LoggerThreadStoreNode
Definition: output.c:109
OutputLogFunc
TmEcode(* OutputLogFunc)(ThreadVars *, Packet *, void *)
Definition: output.h:53
JsonDoh2LogRegister
void JsonDoh2LogRegister(void)
Definition: output-json-dns.c:678
app-layer-ssh.h
JsonDCERPCLogRegister
void JsonDCERPCLogRegister(void)
Definition: output-json-dcerpc.c:67
OutputTxLoggerRegister
void OutputTxLoggerRegister(void)
Definition: output-tx.c:650
alert-debuglog.h
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
JsonPgsqlLogRegister
void JsonPgsqlLogRegister(void)
Definition: output-json-pgsql.c:184
ALPROTO_DNS
@ ALPROTO_DNS
Definition: app-layer-protos.h:41
OutputJsonThreadCtx_::ctx
OutputJsonCtx * ctx
Definition: output-json.h:90
AlertJsonDoh2
bool AlertJsonDoh2(void *txptr, JsonBuilder *js)
Definition: output-json-dns.c:257
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:43
OutputRegisterTxSubModuleWithProgress
void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:352
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
OutputRegisterPacketSubModule
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet output sub-module.
Definition: output.c:206
JsonSMBLogRegister
void JsonSMBLogRegister(void)
Definition: output-json-smb.c:79
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:33
OutputRegisterRootLogger
void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
Definition: output.c:779
output-json-mqtt.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
output-eve-stream.h
OutputFileLoggerRegister
void OutputFileLoggerRegister(void)
Definition: output-file.c:235
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
ALPROTO_MODBUS
@ ALPROTO_MODBUS
Definition: app-layer-protos.h:42
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:81
ALPROTO_QUIC
@ ALPROTO_QUIC
Definition: app-layer-protos.h:51
SCFileLogger
int(* SCFileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, void *tx, const uint64_t tx_id, uint8_t direction)
Definition: output-file.h:48
SCEveJsonSimpleGetLogger
EveJsonSimpleAppLayerLogger * SCEveJsonSimpleGetLogger(AppProto alproto)
Definition: output.c:836
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
JsonLogThreadInit
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
Definition: output-json-common.c:90
OutputModule_::name
const char * name
Definition: output.h:58
Flow_
Flow data structure.
Definition: flow.h:356
LogTlsLogRegister
void LogTlsLogRegister(void)
Definition: log-tlslog.c:500
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:57
LoggerId
LoggerId
Definition: suricata-common.h:460
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:75
AlertFastLogRegister
void AlertFastLogRegister(void)
Definition: alert-fastlog.c:77
output-json-pgsql.h
JsonFileLogRegister
void JsonFileLogRegister(void)
Definition: output-json-file.c:352
OutputJsonBuilderBuffer
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:958
output-json-frame.h
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:79
OutputRegisterStatsSubModule
void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a stats data output sub-module.
Definition: output.c:577
output-json-netflow.h
JsonDNP3LogRegister
void JsonDNP3LogRegister(void)
Definition: output-json-dnp3.c:364
LogCustomFormatRegister
void LogCustomFormatRegister(void)
Definition: log-cf-common.c:271
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
output-json-arp.h
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *conf_name)
Get an output module by name.
Definition: output.c:612
output-json-tls.h
SSHTxLogCondition
bool SSHTxLogCondition(ThreadVars *tv, const Packet *p, void *state, void *tx, uint64_t tx_id)
Definition: app-layer-ssh.c:74
ALPROTO_SIP
@ ALPROTO_SIP
Definition: app-layer-protos.h:54
OutputRegisterTxSubModule
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:377
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:808
AlertSyslogRegister
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
Definition: alert-syslog.c:384
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:75
ALPROTO_LDAP
@ ALPROTO_LDAP
Definition: app-layer-protos.h:60
JsonDHCPLogRegister
void JsonDHCPLogRegister(void)
Definition: output-json-dhcp.c:146
TxLogger
int(* TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
Transaction logger function pointer type.
Definition: output-tx.h:34
FlowLogger
int(* FlowLogger)(ThreadVars *, void *thread_data, Flow *f)
Flow logger function pointer type.
Definition: output-flow.h:36
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:31
PacketLogger
int(* PacketLogger)(ThreadVars *, void *thread_data, const Packet *)
Packet logger function pointer type.
Definition: output-packet.h:35
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
PcapLogRegister
void PcapLogRegister(void)
Definition: log-pcap.c:210
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:62
OutputRegisterFiledataModule
void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, SCFiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file data output module.
Definition: output.c:430
SCFiledataLogger
int(* SCFiledataLogger)(ThreadVars *, void *thread_data, const Packet *, File *, void *tx, const uint64_t tx_id, const uint8_t *, uint32_t, uint8_t, uint8_t dir)
File-data logger function pointer type.
Definition: output-filedata.h:51
ALPROTO_SSH
@ ALPROTO_SSH
Definition: app-layer-protos.h:34
app-layer-ftp.h
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:67
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet output module.
Definition: output.c:169
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:76
EveJsonSimpleTxLogFunc
bool(* EveJsonSimpleTxLogFunc)(void *, struct JsonBuilder *)
Definition: output.h:164
OutputModule_::FiledataLogFunc
SCFiledataLogger FiledataLogFunc
Definition: output.h:72
JsonStatsLogRegister
void JsonStatsLogRegister(void)
Definition: output-json-stats.c:501
LogTcpDataLogRegister
void LogTcpDataLogRegister(void)
Definition: log-tcp-data.c:46
OutputRegisterRootLoggers
void OutputRegisterRootLoggers(void)
Register all root loggers.
Definition: output.c:858
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output.c:753
OutputRegisterTxModule
void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module.
Definition: output.c:369
OutputModule_::alproto
AppProto alproto
Definition: output.h:76
JsonTlsLogRegister
void JsonTlsLogRegister(void)
Definition: output-json-tls.c:668
OutputRegisterFileSubModule
void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, SCFileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a file output sub-module.
Definition: output.c:393
alert-syslog.h
JsonFlowLogRegister
void JsonFlowLogRegister(void)
Definition: output-json-flow.c:349
JsonPgsqlAddMetadata
bool JsonPgsqlAddMetadata(void *vtx, JsonBuilder *jb)
Definition: output-json-pgsql.c:62
TmModuleLoggerRegister
void TmModuleLoggerRegister(void)
Definition: output.c:830
JsonTlsLogJSONExtended
bool JsonTlsLogJSONExtended(void *vtx, JsonBuilder *tjs)
Definition: output-json-tls.c:458
output-json-dcerpc.h
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
Definition: app-layer-ftp.c:1454
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
OutputJsonRegister
void OutputJsonRegister(void)
Definition: output-json.c:83
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:821
ALPROTO_KRB5
@ ALPROTO_KRB5
Definition: app-layer-protos.h:50
OutputJsonThreadCtx_
Definition: output-json.h:89
ALPROTO_SNMP
@ ALPROTO_SNMP
Definition: app-layer-protos.h:53
TAILQ_ENTRY
#define TAILQ_ENTRY(type)
Definition: queue.h:239
RootLogger_::LogFunc
OutputLogFunc LogFunc
Definition: output.c:87
output-json-dnp3.h
OutputRegisterFileRotationFlag
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:663
LogHttpLogRegister
void LogHttpLogRegister(void)
Definition: log-httplog.c:65
AlertJsonDnp3
bool AlertJsonDnp3(void *vtx, JsonBuilder *js)
Definition: output-json-dnp3.c:213
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
Definition: output.c:466
OutputModule_::stream_type
enum SCOutputStreamingType stream_type
Definition: output.h:77
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:64
OutputRegisterTxModuleWithCondition
void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module with condition.
Definition: output.c:320
TAILQ_HEAD_INITIALIZER
#define TAILQ_HEAD_INITIALIZER(head)
Definition: queue.h:236
output_modules
OutputModuleList output_modules
OutputInitSubFunc
OutputInitResult(* OutputInitSubFunc)(ConfNode *, OutputCtx *)
Definition: output.h:52
JsonAnomalyLogRegister
void JsonAnomalyLogRegister(void)
Definition: output-json-anomaly.c:450
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
util-debug.h
output-json-flow.h
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
OutputStreamingLoggerRegister
void OutputStreamingLoggerRegister(void)
Definition: output-streaming.c:434
util-error.h
OutputRegisterStatsModule
void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a stats data output module.
Definition: output.c:541
log-tcp-data.h
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:65
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:44
output-json.h
OutputRegisterTxModuleWithProgress
void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a tx output module with progress.
Definition: output.c:344
output-json-file.h
OutputRegisterModule
void OutputRegisterModule(const char *, const char *, OutputInitFunc)
CreateEveHeader
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Definition: output-json.c:806
JsonIKELogRegister
void JsonIKELogRegister(void)
Definition: output-json-ike.c:182
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:39
OutputModule_::StreamingLogFunc
SCStreamingLogger StreamingLogFunc
Definition: output.h:74
log-tlslog.h
EveFTPLogCommand
bool EveFTPLogCommand(void *vtx, JsonBuilder *jb)
Definition: output-json-ftp.c:49
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *tv, const void *initdata, void **data)
Definition: output.c:722
app-layer-parser.h
JsonMQTTLogRegister
void JsonMQTTLogRegister(void)
Definition: output-json-mqtt.c:193
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
OutputFilestoreRegister
void OutputFilestoreRegister(void)
Definition: output-filestore.c:506
OutputRegisterLoggers
void OutputRegisterLoggers(void)
Register all non-root logging modules.
Definition: output.c:955
OutputModule_::conf_name
const char * conf_name
Definition: output.h:59
output-json-anomaly.h
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:73
OutputDeregisterAll
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
Definition: output.c:629
Packet_
Definition: decode.h:473
RootLogger_::ActiveCntFunc
OutputGetActiveCountFunc ActiveCntFunc
Definition: output.c:90
OutputPacketLoggerRegister
void OutputPacketLoggerRegister(void)
Definition: output-packet.c:194
ALPROTO_RDP
@ ALPROTO_RDP
Definition: app-layer-protos.h:63
conf.h
OutputNotifyFileRotation
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
Definition: output.c:701
TAILQ_HEAD
typedef TAILQ_HEAD(LoggerThreadStore_, LoggerThreadStoreNode_)
Definition: output.c:111
TmEcode
TmEcode
Definition: tm-threads-common.h:79
ALPROTO_DOH2
@ ALPROTO_DOH2
Definition: app-layer-protos.h:61
EveStreamLogRegister
void EveStreamLogRegister(void)
Definition: output-eve-stream.c:452
ALPROTO_TFTP
@ ALPROTO_TFTP
Definition: app-layer-protos.h:48
RootLogger_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.c:88
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:64
EveJsonSimpleAppLayerLogger
Definition: output.h:166
log-pcap.h
alert-fastlog.h
TxLoggerCondition
bool(* TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id)
Transaction logger condition function pointer type.
Definition: output-tx.h:41
LogStatsLogRegister
void LogStatsLogRegister(void)
Definition: log-stats.c:285
JsonFrameLogRegister
void JsonFrameLogRegister(void)
Definition: output-json-frame.c:559
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
Packet_::flow
struct Flow_ * flow
Definition: decode.h:512
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:70
LOG_DIR_PACKET
@ LOG_DIR_PACKET
Definition: output-json.h:37
AlertJsonDns
bool AlertJsonDns(void *txptr, JsonBuilder *js)
Definition: output-json-dns.c:251
suricata-common.h
output-json-stats.h
EveJsonSimpleAppLayerLogger::LogTx
EveJsonSimpleTxLogFunc LogTx
Definition: output.h:167
output-json-nfs.h
ALPROTO_PGSQL
@ ALPROTO_PGSQL
Definition: app-layer-protos.h:57
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
output-filestore.h
FatalError
#define FatalError(...)
Definition: util-debug.h:502
LuaLogRegister
void LuaLogRegister(void)
Definition: output-lua.c:888
ALPROTO_WEBSOCKET
@ ALPROTO_WEBSOCKET
Definition: app-layer-protos.h:59
JsonSmtpLogRegister
void JsonSmtpLogRegister(void)
Definition: output-json-smtp.c:192
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
log-httplog.h
JsonMetadataLogRegister
void JsonMetadataLogRegister(void)
Definition: output-json-metadata.c:95
output-json-alert.h
PacketLogCondition
bool(* PacketLogCondition)(ThreadVars *, void *thread_data, const Packet *)
Packet logger condition function point type.
Definition: output-packet.h:43
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:68
RootLogger
struct RootLogger_ RootLogger
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-json.h:38
output-json-dns.h
OutputGetActiveCountFunc
uint32_t(* OutputGetActiveCountFunc)(void)
Definition: output.h:54
log-cf-common.h
output-json-metadata.h
LOGGER_JSON_TX
@ LOGGER_JSON_TX
Definition: suricata-common.h:468
EveJsonSimpleAppLayerLogger::name
const char * name
Definition: output.h:168
JsonDnsLogRegister
void JsonDnsLogRegister(void)
Definition: output-json-dns.c:671
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *tv, Packet *p, void *thread_data)
Definition: output.c:708
SCFree
#define SCFree(p)
Definition: util-mem.h:61
output-json-dhcp.h
JsonMQTTAddMetadata
bool JsonMQTTAddMetadata(void *vtx, JsonBuilder *js)
Definition: output-json-mqtt.c:63
JsonDropLogRegister
void JsonDropLogRegister(void)
Definition: output-json-drop.c:391
output-json-ike.h
StatsLogger
int(* StatsLogger)(ThreadVars *, void *thread_data, const StatsTable *)
Definition: output-stats.h:50
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:69
ALPROTO_MQTT
@ ALPROTO_MQTT
Definition: app-layer-protos.h:56
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:78
OutputInitFunc
OutputInitResult(* OutputInitFunc)(ConfNode *)
Definition: output.h:51
ALPROTO_TEMPLATE
@ ALPROTO_TEMPLATE
Definition: app-layer-protos.h:62
output-lua.h
ALPROTO_RFB
@ ALPROTO_RFB
Definition: app-layer-protos.h:55
JsonHttpLogRegister
void JsonHttpLogRegister(void)
Definition: output-json-http.c:651
ALPROTO_BITTORRENT_DHT
@ ALPROTO_BITTORRENT_DHT
Definition: app-layer-protos.h:65
output-json-smb.h
JsonArpLogRegister
void JsonArpLogRegister(void)
Definition: output-json-arp.c:104
SCOutputStreamingType
SCOutputStreamingType
Definition: output-streaming.h:35
output-json-smtp.h
JsonLogThreadDeinit
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
Definition: output-json-common.c:123
output-json-http.h
flow.h
OutputModule_
Definition: output.h:56
AlertDebugLogRegister
void AlertDebugLogRegister(void)
Definition: alert-debuglog.c:485
OutputUnregisterFileRotationFlag
void OutputUnregisterFileRotationFlag(int *flag)
Unregister a file rotation flag.
Definition: output.c:684
OutputRegisterTxSubModuleWithCondition
void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:328
log-tlsstore.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:455
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
OutputFiledataLoggerRegister
void OutputFiledataLoggerRegister(void)
Definition: output-filedata.c:271
SCStreamingLogger
int(* SCStreamingLogger)(ThreadVars *, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags)
Definition: output-streaming.h:41
output.h
JsonAlertLogRegister
void JsonAlertLogRegister(void)
Definition: output-json-alert.c:1051
JsonNFSLogRegister
void JsonNFSLogRegister(void)
Definition: output-json-nfs.c:110
OutputDropLoggerDisable
void OutputDropLoggerDisable(void)
Definition: output.c:651
JsonNetFlowLogRegister
void JsonNetFlowLogRegister(void)
Definition: output-json-netflow.c:295
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:40
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:61
RootLogger_
Definition: output.c:86
output-json-drop.h