suricata
output.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
22  */
23 
24 #ifndef SURICATA_OUTPUT_H
25 #define SURICATA_OUTPUT_H
26 
27 #include "decode.h"
28 #include "tm-modules.h"
29 
30 #define DEFAULT_LOG_MODE_APPEND "yes"
31 #define DEFAULT_LOG_FILETYPE "regular"
32 
33 typedef struct OutputLoggerThreadStore_ {
34  void *thread_data;
37 
38 #include "output-packet.h"
39 #include "output-tx.h"
40 #include "output-file.h"
41 #include "output-filedata.h"
42 #include "output-flow.h"
43 #include "output-streaming.h"
44 #include "output-stats.h"
45 
46 typedef struct OutputInitResult_ {
48  bool ok;
50 
53 typedef TmEcode (*OutputLogFunc)(ThreadVars *, Packet *, void *);
54 typedef uint32_t (*OutputGetActiveCountFunc)(void);
55 
56 typedef struct OutputModule_ {
58  const char *name;
59  const char *conf_name;
60  const char *parent_name;
63 
67 
81 
84 
85 typedef TAILQ_HEAD(OutputModuleList_, OutputModule_) OutputModuleList;
86 extern OutputModuleList output_modules;
87 
88 void OutputRegisterModule(const char *, const char *, OutputInitFunc);
89 
90 void OutputRegisterPacketModule(LoggerId id, const char *name,
91  const char *conf_name, OutputInitFunc InitFunc, PacketLogger LogFunc,
94 void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name,
95  const char *name, const char *conf_name, OutputInitSubFunc InitFunc,
96  PacketLogger LogFunc, PacketLogCondition ConditionFunc,
97  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit,
98  ThreadExitPrintStatsFunc ThreadExitPrintStats);
99 
100 void OutputRegisterTxModule(LoggerId id, const char *name,
101  const char *conf_name, OutputInitFunc InitFunc, AppProto alproto,
102  TxLogger TxLogFunc, ThreadInitFunc ThreadInit,
103  ThreadDeinitFunc ThreadDeinit,
104  ThreadExitPrintStatsFunc ThreadExitPrintStats);
105 void OutputRegisterTxSubModule(LoggerId id, const char *parent_name,
106  const char *name, const char *conf_name,
107  OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
108  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit,
109  ThreadExitPrintStatsFunc ThreadExitPrintStats);
110 
111 void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name,
112  const char *conf_name, OutputInitFunc InitFunc, AppProto alproto,
113  TxLogger TxLogFunc, TxLoggerCondition TxLogCondition,
114  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit,
115  ThreadExitPrintStatsFunc ThreadExitPrintStats);
117  const char *parent_name, const char *name, const char *conf_name,
118  OutputInitSubFunc InitFunc, AppProto alproto,
119  TxLogger TxLogFunc, TxLoggerCondition TxLogCondition,
120  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit,
121  ThreadExitPrintStatsFunc ThreadExitPrintStats);
122 
123 void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name,
124  const char *conf_name, OutputInitFunc InitFunc, AppProto alproto,
125  TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress,
126  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit,
127  ThreadExitPrintStatsFunc ThreadExitPrintStats);
128 void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name,
129  const char *name, const char *conf_name,
130  OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc,
131  int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit,
132  ThreadDeinitFunc ThreadDeinit,
133  ThreadExitPrintStatsFunc ThreadExitPrintStats);
134 
135 void OutputRegisterFileSubModule(LoggerId id, const char *parent_name,
136  const char *name, const char *conf_name,
137  OutputInitSubFunc InitFunc, FileLogger FileLogFunc,
138  ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit,
139  ThreadExitPrintStatsFunc ThreadExitPrintStats);
140 
141 void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name,
142  OutputInitFunc InitFunc, FiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit,
143  ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats);
144 
145 void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name,
146  const char *name, const char *conf_name, OutputInitSubFunc InitFunc,
147  FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit,
148  ThreadDeinitFunc ThreadDeinit,
149  ThreadExitPrintStatsFunc ThreadExitPrintStats);
150 
151 void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name,
152  OutputInitFunc InitFunc, StreamingLogger StreamingLogFunc,
153  enum OutputStreamingType stream_type, ThreadInitFunc ThreadInit,
154  ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats);
155 
156 void OutputRegisterStatsModule(LoggerId id, const char *name,
157  const char *conf_name, OutputInitFunc InitFunc,
158  StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit,
159  ThreadDeinitFunc ThreadDeinit,
160  ThreadExitPrintStatsFunc ThreadExitPrintStats);
161 void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name,
162  const char *name, const char *conf_name,
163  OutputInitSubFunc InitFunc,
164  StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit,
165  ThreadDeinitFunc ThreadDeinit,
166  ThreadExitPrintStatsFunc ThreadExitPrintStats);
167 
168 OutputModule *OutputGetModuleByConfName(const char *name);
169 void OutputDeregisterAll(void);
170 
171 int OutputDropLoggerEnable(void);
172 void OutputDropLoggerDisable(void);
173 
174 void OutputRegisterFileRotationFlag(int *flag);
175 void OutputUnregisterFileRotationFlag(int *flag);
176 void OutputNotifyFileRotation(void);
177 
179  ThreadDeinitFunc ThreadDeinit,
180  ThreadExitPrintStatsFunc ThreadExitPrintStats,
181  OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc);
182 void TmModuleLoggerRegister(void);
183 
185 TmEcode OutputLoggerThreadInit(ThreadVars *, const void *, void **);
187 void OutputLoggerExitPrintStats(ThreadVars *, void *);
188 
189 void OutputSetupActiveLoggers(void);
190 void OutputClearActiveLoggers(void);
191 
192 typedef bool (*EveJsonSimpleTxLogFunc)(void *, struct JsonBuilder *);
193 
198 
200 
201 #endif /* ! SURICATA_OUTPUT_H */
OutputRegisterTxModule
void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a tx output module.
Definition: output.c:394
OutputRegisterFileSubModule
void OutputRegisterFileSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FileLogger FileLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a file output sub-module.
Definition: output.c:424
OutputRegisterPacketSubModule
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger LogFunc, PacketLogCondition ConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output sub-module.
Definition: output.c:210
OutputModule_::parent_name
const char * parent_name
Definition: output.h:60
OutputRegisterTxSubModuleWithProgress
void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output.c:374
output-tx.h
OutputLogFunc
TmEcode(* OutputLogFunc)(ThreadVars *, Packet *, void *)
Definition: output.h:53
OutputLoggerThreadStore_
Definition: output.h:33
OutputLoggerThreadInit
TmEcode OutputLoggerThreadInit(ThreadVars *, const void *, void **)
Definition: output.c:766
TAILQ_HEAD
typedef TAILQ_HEAD(OutputModuleList_, OutputModule_) OutputModuleList
OutputRegisterRootLogger
void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
Definition: output.c:837
output-filedata.h
OutputModule
struct OutputModule_ OutputModule
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
output-streaming.h
OutputInitResult
struct OutputInitResult_ OutputInitResult
OutputModule_::name
const char * name
Definition: output.h:58
OutputModule_::StreamingLogFunc
StreamingLogger StreamingLogFunc
Definition: output.h:75
OutputModule_::FileLogFunc
FileLogger FileLogFunc
Definition: output.h:72
StreamingLogger
int(* StreamingLogger)(ThreadVars *, void *thread_data, const Flow *f, const uint8_t *data, uint32_t data_len, uint64_t tx_id, uint8_t flags)
Definition: output-streaming.h:41
OutputModule_::logger_id
LoggerId logger_id
Definition: output.h:57
LoggerId
LoggerId
Definition: suricata-common.h:460
OutputModule_::ts_log_progress
int ts_log_progress
Definition: output.h:80
OutputLoggerThreadStore_::next
struct OutputLoggerThreadStore_ * next
Definition: output.h:35
EveJsonSimpleAppLayerLogger::proto
AppProto proto
Definition: output.h:195
OutputModule_::StatsLogFunc
StatsLogger StatsLogFunc
Definition: output.h:76
OutputModule_::TAILQ_ENTRY
TAILQ_ENTRY(OutputModule_) entries
tm-modules.h
TxLogger
int(* TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
Definition: output-tx.h:33
FlowLogger
int(* FlowLogger)(ThreadVars *, void *thread_data, Flow *f)
Definition: output-flow.h:32
output-packet.h
OutputRegisterFiledataModule
void OutputRegisterFiledataModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FiledataLogger FiledataLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a file data output module.
Definition: output.c:464
PacketLogger
int(* PacketLogger)(ThreadVars *, void *thread_data, const Packet *)
Definition: output-packet.h:30
OutputModule_::InitSubFunc
OutputInitSubFunc InitSubFunc
Definition: output.h:62
OutputGetModuleByConfName
OutputModule * OutputGetModuleByConfName(const char *name)
Get an output module by name.
Definition: output.c:660
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger LogFunc, PacketLogCondition ConditionFunc, ThreadInitFunc, ThreadDeinitFunc, ThreadExitPrintStatsFunc)
Register a packet output module.
Definition: output.c:170
OutputRegisterStatsSubModule
void OutputRegisterStatsSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a stats data output sub-module.
Definition: output.c:622
OutputModule_::PacketLogFunc
PacketLogger PacketLogFunc
Definition: output.h:68
OutputLoggerLog
TmEcode OutputLoggerLog(ThreadVars *, Packet *, void *)
Definition: output.c:752
EveJsonSimpleTxLogFunc
bool(* EveJsonSimpleTxLogFunc)(void *, struct JsonBuilder *)
Definition: output.h:192
OutputModule_::alproto
AppProto alproto
Definition: output.h:77
OutputDeregisterAll
void OutputDeregisterAll(void)
Deregister all modules. Useful for a memory clean exit.
Definition: output.c:675
OutputCtx_
Definition: tm-modules.h:85
OutputModule_::stream_type
enum OutputStreamingType stream_type
Definition: output.h:78
OutputRegisterStatsModule
void OutputRegisterStatsModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StatsLogger StatsLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a stats data output module.
Definition: output.c:584
OutputLoggerThreadStore_::thread_data
void * thread_data
Definition: output.h:34
OutputRegisterTxSubModuleWithCondition
void OutputRegisterTxSubModuleWithCondition(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output.c:343
OutputModule_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output.h:64
SCEveJsonSimpleGetLogger
EveJsonSimpleAppLayerLogger * SCEveJsonSimpleGetLogger(AppProto alproto)
Definition: output.c:1162
output_modules
OutputModuleList output_modules
OutputInitSubFunc
OutputInitResult(* OutputInitSubFunc)(ConfNode *, OutputCtx *)
Definition: output.h:52
OutputDropLoggerDisable
void OutputDropLoggerDisable(void)
Definition: output.c:695
decode.h
OutputModule_::FiledataLogFunc
FiledataLogger FiledataLogFunc
Definition: output.h:73
FileLogger
int(* FileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, void *tx, const uint64_t tx_id, uint8_t direction)
Definition: output-file.h:48
OutputRegisterTxModuleWithProgress
void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a tx output module with progress.
Definition: output.c:363
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
FiledataLogger
int(* FiledataLogger)(ThreadVars *, void *thread_data, const Packet *, File *, void *tx, const uint64_t tx_id, const uint8_t *, uint32_t, uint8_t, uint8_t dir)
Definition: output-filedata.h:49
OutputModule_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output.h:65
output-file.h
OutputRegisterModule
void OutputRegisterModule(const char *, const char *, OutputInitFunc)
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:40
OutputInitResult_::ok
bool ok
Definition: output.h:48
OutputRegisterStreamingModule
void OutputRegisterStreamingModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, StreamingLogger StreamingLogFunc, enum OutputStreamingType stream_type, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a streaming data output module.
Definition: output.c:543
OutputLoggerThreadStore
struct OutputLoggerThreadStore_ OutputLoggerThreadStore
OutputUnregisterFileRotationFlag
void OutputUnregisterFileRotationFlag(int *flag)
Unregister a file rotation flag.
Definition: output.c:728
OutputModule_::conf_name
const char * conf_name
Definition: output.h:59
OutputModule_::FlowLogFunc
FlowLogger FlowLogFunc
Definition: output.h:74
Packet_
Definition: decode.h:482
EveJsonSimpleAppLayerLogger
struct EveJsonSimpleAppLayerLogger EveJsonSimpleAppLayerLogger
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output sub-module.
Definition: output.c:503
TmModuleLoggerRegister
void TmModuleLoggerRegister(void)
Definition: output.c:892
OutputClearActiveLoggers
void OutputClearActiveLoggers(void)
Definition: output.c:883
TmEcode
TmEcode
Definition: tm-threads-common.h:83
output-flow.h
OutputModule_::ThreadExitPrintStats
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output.h:66
EveJsonSimpleAppLayerLogger
Definition: output.h:194
TxLoggerCondition
bool(* TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id)
Definition: output-tx.h:38
OutputDropLoggerEnable
int OutputDropLoggerEnable(void)
Definition: output.c:687
OutputInitResult_
Definition: output.h:46
OutputModule_::TxLogCondition
TxLoggerCondition TxLogCondition
Definition: output.h:71
EveJsonSimpleAppLayerLogger::LogTx
EveJsonSimpleTxLogFunc LogTx
Definition: output.h:196
ThreadExitPrintStatsFunc
void(* ThreadExitPrintStatsFunc)(ThreadVars *, void *)
Definition: tm-modules.h:42
OutputRegisterTxModuleWithCondition
void OutputRegisterTxModuleWithCondition(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, TxLoggerCondition TxLogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a tx output module with condition.
Definition: output.c:332
OutputLoggerThreadDeinit
TmEcode OutputLoggerThreadDeinit(ThreadVars *, void *)
Definition: output.c:797
PacketLogCondition
bool(* PacketLogCondition)(ThreadVars *, void *thread_data, const Packet *)
Definition: output-packet.h:35
OutputModule_::PacketConditionFunc
PacketLogCondition PacketConditionFunc
Definition: output.h:69
OutputGetActiveCountFunc
uint32_t(* OutputGetActiveCountFunc)(void)
Definition: output.h:54
OutputRegisterFileRotationFlag
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:707
OutputStreamingType
OutputStreamingType
Definition: output-streaming.h:35
OutputNotifyFileRotation
void OutputNotifyFileRotation(void)
Notifies all registered file rotation notification flags.
Definition: output.c:745
ConfNode_
Definition: conf.h:32
StatsLogger
int(* StatsLogger)(ThreadVars *, void *thread_data, const StatsTable *)
Definition: output-stats.h:50
OutputModule_::TxLogFunc
TxLogger TxLogFunc
Definition: output.h:70
OutputModule_::tc_log_progress
int tc_log_progress
Definition: output.h:79
OutputInitFunc
OutputInitResult(* OutputInitFunc)(ConfNode *)
Definition: output.h:51
output-stats.h
OutputLoggerExitPrintStats
void OutputLoggerExitPrintStats(ThreadVars *, void *)
Definition: output.c:823
OutputModule_
Definition: output.h:56
OutputRegisterTxSubModule
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output.c:405
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:41
OutputModule_::InitFunc
OutputInitFunc InitFunc
Definition: output.h:61
OutputSetupActiveLoggers
void OutputSetupActiveLoggers(void)
Definition: output.c:870