suricata
util-debug.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
22  *
23  * Debug utility functions
24  */
25 
26 #include "suricata-common.h"
27 #include "util-debug.h"
28 
29 #include "output.h"
30 
31 #include "suricata.h"
32 
33 #include "util-conf.h"
34 #include "util-enum.h"
35 #include "util-path.h"
36 #include "util-syslog.h"
37 #include "util-time.h"
38 
39 // clang-format off
40 /* holds the string-enum mapping for the enums held in the table SCLogLevel */
42  { "Not set", SC_LOG_NOTSET },
43  { "None", SC_LOG_NONE },
44  { "Error", SC_LOG_ERROR },
45  { "Warning", SC_LOG_WARNING },
46  { "Notice", SC_LOG_NOTICE },
47  { "Info", SC_LOG_INFO },
48  { "Perf", SC_LOG_PERF },
49  { "Config", SC_LOG_CONFIG },
50  { "Debug", SC_LOG_DEBUG },
51  { NULL, -1 }
52 };
53 
55  { "Not set", SC_LOG_NOTSET },
56  { "None", SC_LOG_NONE },
57  { "E", SC_LOG_ERROR },
58  { "W", SC_LOG_WARNING },
59  { "i", SC_LOG_NOTICE },
60  { "i", SC_LOG_INFO },
61  { "i", SC_LOG_PERF },
62  { "i", SC_LOG_CONFIG },
63  { "d", SC_LOG_DEBUG },
64  { NULL, -1 }
65 };
66 
67 /* holds the string-enum mapping for the enums held in the table SCLogOPIface */
69  { "Console", SC_LOG_OP_IFACE_CONSOLE },
70  { "File", SC_LOG_OP_IFACE_FILE },
71  { "Syslog", SC_LOG_OP_IFACE_SYSLOG },
72  { NULL, -1 }
73 };
74 // clang-format on
75 
76 #if defined (OS_WIN32)
77 /**
78  * \brief Used for synchronous output on WIN32
79  */
80 static SCMutex sc_log_stream_lock;
81 #endif /* OS_WIN32 */
82 
83 /**
84  * \brief Transform the module name into display module name for logging
85  */
86 static const char *SCTransformModule(const char *module_name, int *dn_len);
87 
88 /**
89  * \brief Holds the config state for the logging module
90  */
91 static SCLogConfig *sc_log_config = NULL;
92 
93 /**
94  * \brief Returns the full path given a file and configured log dir
95  */
96 static char *SCLogGetLogFilename(const char *);
97 
98 /**
99  * \brief Holds the global log level. Is the same as sc_log_config->log_level
100  */
102 
103 /**
104  * \brief Used to indicate whether the logging module has been init or not
105  */
107 
108 /**
109  * \brief Used to indicate whether the logging module has been cleaned or not
110  */
112 
113 /**
114  * \brief Maps the SC logging level to the syslog logging level
115  *
116  * \param The SC logging level that has to be mapped to the syslog_log_level
117  *
118  * \retval syslog_log_level The mapped syslog_api_log_level, for the logging
119  * module api's internal log_level
120  */
121 static inline int SCLogMapLogLevelToSyslogLevel(int log_level)
122 {
123  int syslog_log_level = 0;
124 
125  switch (log_level) {
126  case SC_LOG_ERROR:
127  syslog_log_level = LOG_ERR;
128  break;
129  case SC_LOG_WARNING:
130  syslog_log_level = LOG_WARNING;
131  break;
132  case SC_LOG_NOTICE:
133  syslog_log_level = LOG_NOTICE;
134  break;
135  case SC_LOG_INFO:
136  syslog_log_level = LOG_INFO;
137  break;
138  case SC_LOG_CONFIG:
139  case SC_LOG_DEBUG:
140  case SC_LOG_PERF:
141  syslog_log_level = LOG_DEBUG;
142  break;
143  default:
144  syslog_log_level = LOG_EMERG;
145  break;
146  }
147 
148  return syslog_log_level;
149 }
150 
151 /**
152  * \brief Output function that logs a character string out to a file descriptor
153  *
154  * \param fd Pointer to the file descriptor
155  * \param msg Pointer to the character string that should be logged
156  */
157 static inline void SCLogPrintToStream(FILE *fd, char *msg)
158 {
159  /* Would only happen if the log file failed to re-open during rotation. */
160  if (fd == NULL) {
161  return;
162  }
163 
164 #if defined (OS_WIN32)
165  SCMutexLock(&sc_log_stream_lock);
166 #endif /* OS_WIN32 */
167 
168  if (fprintf(fd, "%s\n", msg) < 0)
169  printf("Error writing to stream using fprintf\n");
170 
171  fflush(fd);
172 
173 #if defined (OS_WIN32)
174  SCMutexUnlock(&sc_log_stream_lock);
175 #endif /* OS_WIN32 */
176 
177  return;
178 }
179 
180 /**
181  * \brief Output function that logs a character string through the syslog iface
182  *
183  * \param syslog_log_level Holds the syslog_log_level that the message should be
184  * logged as
185  * \param msg Pointer to the char string, that should be logged
186  *
187  * \todo syslog is thread-safe according to POSIX manual and glibc code, but we
188  * we will have to look into non POSIX compliant boxes like freeBSD
189  */
190 static inline void SCLogPrintToSyslog(int syslog_log_level, const char *msg)
191 {
192  //static struct syslog_data data = SYSLOG_DATA_INIT;
193  //syslog_r(syslog_log_level, NULL, "%s", msg);
194 
195  syslog(syslog_log_level, "%s", msg);
196 
197  return;
198 }
199 
200 /**
201  */
202 static int SCLogMessageJSON(SCTime_t tval, char *buffer, size_t buffer_size, SCLogLevel log_level,
203  const char *file, unsigned line, const char *function, const char *module,
204  const char *message)
205 {
206  JsonBuilder *js = jb_new_object();
207  if (unlikely(js == NULL))
208  goto error;
209 
210  char timebuf[64];
211  CreateIsoTimeString(tval, timebuf, sizeof(timebuf));
212  jb_set_string(js, "timestamp", timebuf);
213 
214  const char *s = SCMapEnumValueToName(log_level, sc_log_level_map);
215  if (s != NULL) {
216  jb_set_string(js, "log_level", s);
217  } else {
218  JB_SET_STRING(js, "log_level", "INVALID");
219  }
220 
221  JB_SET_STRING(js, "event_type", "engine");
222  jb_open_object(js, "engine");
223 
224  if (message)
225  jb_set_string(js, "message", message);
226 
227  if (t_thread_name[0] != '\0') {
228  jb_set_string(js, "thread_name", t_thread_name);
229  }
230 
231  if (module) {
232  /* Determine how much of module name to display */
233  int dn_len = 0;
234  const char *dn_name;
235  dn_name = SCTransformModule(module, &dn_len);
236  jb_set_string(js, "module", dn_name);
237  }
238 
239  if (log_level >= SC_LOG_DEBUG) {
240  if (function)
241  jb_set_string(js, "function", function);
242 
243  if (file)
244  jb_set_string(js, "file", file);
245 
246  if (line > 0)
247  jb_set_uint(js, "line", line);
248  }
249  jb_close(js); // engine
250 
251  jb_close(js);
252  memcpy(buffer, jb_ptr(js), MIN(buffer_size, jb_len(js)));
253 
254  jb_free(js);
255 
256  return 0;
257 
258 error:
259  return -1;
260 }
261 
262 static const int transform_max_segs = 2; /* The maximum segment count to display */
263 /*
264  * \brief Return a display name for the given module name for logging.
265  *
266  * The transformation is dependent upon the source code module names
267  * that use the dash character to separate incremental refinements of
268  * the subsystem.
269  *
270  * The transformation uses the local constant "transform_max_segs" to determine
271  * how many segments to display; the transformed name will never consist
272  * of more than this many segments.
273  *
274  * E.g., "detect-http-content-len" ==> "detect-http" when the max is 2
275  *
276  * \param module_name The source code module name to be transformed.
277  * \param dn_len The number of characters in the display name to print.
278  *
279  * \retval Pointer to the display name
280  */
281 static const char *SCTransformModule(const char *module_name, int *dn_len)
282 {
283  /*
284  * special case for source code module names beginning with:
285  * Prefixes skipped
286  * tm-*
287  * util-*
288  * source-*
289  * No transformation
290  * app-layer-*
291  */
292  if (strncmp("tm-", module_name, 3) == 0) {
293  *dn_len = strlen(module_name) - 3;
294  return module_name + 3;
295  } else if (strncmp("util-", module_name, 5) == 0) {
296  *dn_len = strlen(module_name) - 5;
297  return module_name + 5;
298  } else if (strncmp("source-pcap-file", module_name, 16) == 0) {
299  *dn_len = strlen("pcap");
300  return "pcap";
301  } else if (strncmp("source-", module_name, 7) == 0) {
302  *dn_len = strlen(module_name) - 7;
303  return module_name + 7;
304  } else if (strncmp("runmode-", module_name, 8) == 0) {
305  *dn_len = strlen(module_name) - 8;
306  return module_name + 8;
307  } else if (strncmp("app-layer-", module_name, 10) == 0) {
308  *dn_len = strlen(module_name);
309  return module_name;
310  } else if (strncmp("detect-engine", module_name, 13) == 0) {
311  *dn_len = strlen("detect");
312  return "detect";
313  }
314 
315  int seg_cnt = 0;
316 
317  char *last;
318  char *w = (char *)module_name;
319  while (w && (w = strchr(w, '-')) != NULL && seg_cnt < transform_max_segs) {
320  seg_cnt++;
321  last = w;
322  w++; /* skip past '-' */
323  }
324 
325  if (seg_cnt < transform_max_segs)
326  *dn_len = strlen(module_name);
327  else
328  *dn_len = last - module_name;
329 
330  return module_name;
331 }
332 
333 /**
334  * \brief Adds the global log_format to the outgoing buffer
335  *
336  * \param log_level log_level of the message that has to be logged
337  * \param msg Buffer containing the outgoing message
338  * \param file File_name from where the message originated
339  * \param function Function_name from where the message originated
340  * \param line Line_no from where the messaged originated
341  *
342  * \retval 0 on success; else a negative value on error
343  */
344 static SCError SCLogMessageGetBuffer(SCTime_t tval, int color, SCLogOPType type, char *buffer,
345  size_t buffer_size, const char *log_format, const SCLogLevel log_level, const char *file,
346  const unsigned int line, const char *function, const char *module, const char *message)
347 {
348  if (type == SC_LOG_OP_TYPE_JSON)
349  return SCLogMessageJSON(
350  tval, buffer, buffer_size, log_level, file, line, function, module, message);
351 
352  char *temp = buffer;
353  const char *s = NULL;
354  struct tm *tms = NULL;
355 
356  const char *redb = "";
357  const char *red = "";
358  const char *yellowb = "";
359  const char *yellow = "";
360  const char *green = "";
361  const char *blue = "";
362  const char *reset = "";
363  if (color) {
364  redb = "\x1b[1;31m";
365  red = "\x1b[31m";
366  yellowb = "\x1b[1;33m";
367  yellow = "\x1b[33m";
368  green = "\x1b[32m";
369  blue = "\x1b[34m";
370  reset = "\x1b[0m";
371  }
372  /* no of characters_written(cw) by snprintf */
373  int cw = 0;
374 
376 
377  /* make a copy of the format string as it will be modified below */
378  const int add_M = strstr(log_format, "%M") == NULL;
379  char local_format[strlen(log_format) + add_M * 2 + 1];
380  strlcpy(local_format, log_format, sizeof(local_format));
381  if (add_M)
382  strlcat(local_format, "%M", sizeof(local_format));
383  char *temp_fmt = local_format;
384  char *substr = temp_fmt;
385  struct tm local_tm;
386 
387  while ((temp_fmt = strchr(temp_fmt, SC_LOG_FMT_PREFIX))) {
388  if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
389  return 0;
390  }
391  switch(temp_fmt[1]) {
392  case SC_LOG_FMT_TIME:
393  temp_fmt[0] = '\0';
394 
395  tms = SCLocalTime(SCTIME_SECS(tval), &local_tm);
396 
397  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
398  "%s%s%04d-%02d-%02d %02d:%02d:%02d%s", substr, green, tms->tm_year + 1900,
399  tms->tm_mon + 1, tms->tm_mday, tms->tm_hour, tms->tm_min, tms->tm_sec,
400  reset);
401  if (cw < 0)
402  return -1;
403  temp += cw;
404  temp_fmt++;
405  substr = temp_fmt;
406  substr++;
407  break;
408 
410  temp_fmt[0] = '\0';
411 
412  tms = SCLocalTime(SCTIME_SECS(tval), &local_tm);
413 
414  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
415  "%s%s%d/%d/%04d -- %02d:%02d:%02d%s",
416  substr, green, tms->tm_mday, tms->tm_mon + 1,
417  tms->tm_year + 1900, tms->tm_hour, tms->tm_min,
418  tms->tm_sec, reset);
419  if (cw < 0)
420  return -1;
421  temp += cw;
422  temp_fmt++;
423  substr = temp_fmt;
424  substr++;
425  break;
426 
427  case SC_LOG_FMT_PID:
428  temp_fmt[0] = '\0';
429  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
430  "%s%s%u%s", substr, yellow, getpid(), reset);
431  if (cw < 0)
432  return -1;
433  temp += cw;
434  temp_fmt++;
435  substr = temp_fmt;
436  substr++;
437  break;
438 
439  case SC_LOG_FMT_TID:
440  temp_fmt[0] = '\0';
441  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
442  "%s%s%lu%s", substr, yellow, SCGetThreadIdLong(), reset);
443  if (cw < 0)
444  return -1;
445  temp += cw;
446  temp_fmt++;
447  substr = temp_fmt;
448  substr++;
449  break;
450 
452  case SC_LOG_FMT_TM:
453  temp_fmt[0] = '\0';
454  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr,
455  yellow, t_thread_name, reset);
456  if (cw < 0)
457  return -1;
458  temp += cw;
459  temp_fmt++;
460  substr = temp_fmt;
461  substr++;
462  break;
463 
465  temp_fmt[0] = '\0';
466  s = SCMapEnumValueToName(log_level, sc_log_level_map);
467  if (s != NULL) {
468  if (log_level <= SC_LOG_ERROR)
469  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
470  "%s%s%s%s", substr, redb, s, reset);
471  else if (log_level == SC_LOG_WARNING)
472  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
473  "%s%s%s%s", substr, red, s, reset);
474  else if (log_level == SC_LOG_NOTICE)
475  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
476  "%s%s%s%s", substr, yellowb, s, reset);
477  else
478  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s",
479  substr, yellow, s, reset);
480  } else {
481  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s", substr,
482  "INVALID");
483  }
484  if (cw < 0)
485  return -1;
486  temp += cw;
487  temp_fmt++;
488  substr = temp_fmt;
489  substr++;
490  break;
491 
493  temp_fmt[0] = '\0';
494  s = SCMapEnumValueToName(log_level, sc_log_slevel_map);
495  if (s != NULL) {
496  if (log_level <= SC_LOG_ERROR)
497  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s",
498  substr, redb, s, reset);
499  else if (log_level == SC_LOG_WARNING)
500  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s",
501  substr, red, s, reset);
502  else if (log_level == SC_LOG_NOTICE)
503  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s",
504  substr, yellowb, s, reset);
505  else
506  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
507  "%s%s%s%s", substr, yellow, s, reset);
508  } else {
509  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
510  "%s%s", substr, "INVALID");
511  }
512  if (cw < 0)
513  return -1;
514  temp += cw;
515  temp_fmt++;
516  substr = temp_fmt;
517  substr++;
518  break;
519 
521  temp_fmt[0] = '\0';
522  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
523  "%s%s%s%s", substr, blue, file, reset);
524  if (cw < 0)
525  return -1;
526  temp += cw;
527  temp_fmt++;
528  substr = temp_fmt;
529  substr++;
530  break;
531 
532  case SC_LOG_FMT_LINE:
533  temp_fmt[0] = '\0';
534  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
535  "%s%s%u%s", substr, green, line, reset);
536  if (cw < 0)
537  return -1;
538  temp += cw;
539  temp_fmt++;
540  substr = temp_fmt;
541  substr++;
542  break;
543 
545  temp_fmt[0] = '\0';
546 
547  /* Determine how much of module name to display */
548  int dn_len = 0;
549  const char *dn_name = "unknown";
550  if (module) {
551  dn_name = SCTransformModule(module, &dn_len);
552  }
553 
554  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s%s", substr,
555  green, dn_name, reset);
556  if (cw < 0)
557  return -1;
558  temp += cw;
559  temp_fmt++;
560  substr = temp_fmt;
561  substr++;
562  break;
563 
564  case SC_LOG_FMT_FUNCTION:
565  temp_fmt[0] = '\0';
566  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer),
567  "%s%s%s%s", substr, green, function, reset);
568  if (cw < 0)
569  return -1;
570  temp += cw;
571  temp_fmt++;
572  substr = temp_fmt;
573  substr++;
574  break;
575 
576  case SC_LOG_FMT_MESSAGE: {
577  temp_fmt[0] = '\0';
578  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s", substr);
579  if (cw < 0) {
580  return -1;
581  }
582  temp += cw;
583  if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
584  return 0;
585  }
586  const char *hi = "";
587  if (log_level <= SC_LOG_ERROR)
588  hi = red;
589  else if (log_level <= SC_LOG_NOTICE)
590  hi = yellow;
591  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s", hi, message,
592  reset);
593  if (cw < 0) {
594  return -1;
595  }
596  temp += cw;
597  if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
598  return 0;
599  }
600  temp_fmt++;
601  substr = temp_fmt;
602  substr++;
603  break;
604  }
605  }
606  temp_fmt++;
607  }
608  if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
609  return 0;
610  }
611  cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s", substr);
612  if (cw < 0) {
613  return -1;
614  }
615  if (sc_log_config->op_filter_regex != NULL) {
616  if (pcre2_match(sc_log_config->op_filter_regex, (PCRE2_SPTR8)buffer, strlen(buffer), 0, 0,
617  sc_log_config->op_filter_regex_match, NULL) < 0) {
618  return -1; // bit hacky, but just return !0
619  }
620  }
621 
622  return 0;
623 }
624 
625 /** \internal
626  * \brief try to reopen file
627  * \note no error reporting here, as we're called by SCLogMessage
628  * \retval status 0 ok, -1 error */
629 static int SCLogReopen(SCLogOPIfaceCtx *op_iface_ctx)
630 {
631  if (op_iface_ctx->file == NULL) {
632  return 0;
633  }
634 
635  if (op_iface_ctx->file_d != NULL) {
636  fclose(op_iface_ctx->file_d);
637  }
638  op_iface_ctx->file_d = fopen(op_iface_ctx->file, "a");
639  if (op_iface_ctx->file_d == NULL) {
640  return -1;
641  }
642  return 0;
643 }
644 
645 /**
646  * \brief Adds the global log_format to the outgoing buffer
647  *
648  * \param log_level log_level of the message that has to be logged
649  * \param msg Buffer containing the outgoing message
650  * \param file File_name from where the message originated
651  * \param function Function_name from where the message originated
652  * \param line Line_no from where the messaged originated
653  *
654  * \retval SC_OK on success; else an error code
655  */
656 SCError SCLogMessage(const SCLogLevel log_level, const char *file, const unsigned int line,
657  const char *function, const char *module, const char *message)
658 {
659  char buffer[SC_LOG_MAX_LOG_MSG_LEN] = "";
660  SCLogOPIfaceCtx *op_iface_ctx = NULL;
661 
662  if (sc_log_module_initialized != 1) {
663  printf("Logging module not initialized. Call SCLogInitLogModule() "
664  "first before using the debug API\n");
665  return SC_OK;
666  }
667 
668  /* get ts here so we log the same ts to each output */
669  SCTime_t ts = TimeGet();
670 
671  op_iface_ctx = sc_log_config->op_ifaces;
672  while (op_iface_ctx != NULL) {
673  if (log_level != SC_LOG_NOTSET && log_level > op_iface_ctx->log_level) {
674  op_iface_ctx = op_iface_ctx->next;
675  continue;
676  }
677 
678  switch (op_iface_ctx->iface) {
680  if (SCLogMessageGetBuffer(ts, op_iface_ctx->use_color, op_iface_ctx->type, buffer,
681  sizeof(buffer),
682  op_iface_ctx->log_format ? op_iface_ctx->log_format
683  : sc_log_config->log_format,
684  log_level, file, line, function, module, message) == 0) {
685  SCLogPrintToStream((log_level == SC_LOG_ERROR)? stderr: stdout, buffer);
686  }
687  break;
689  if (SCLogMessageGetBuffer(ts, 0, op_iface_ctx->type, buffer, sizeof(buffer),
690  op_iface_ctx->log_format ? op_iface_ctx->log_format
691  : sc_log_config->log_format,
692  log_level, file, line, function, module, message) == 0) {
693  int r = 0;
694  SCMutexLock(&op_iface_ctx->fp_mutex);
695  if (op_iface_ctx->rotation_flag) {
696  r = SCLogReopen(op_iface_ctx);
697  op_iface_ctx->rotation_flag = 0;
698  }
699  SCLogPrintToStream(op_iface_ctx->file_d, buffer);
700  SCMutexUnlock(&op_iface_ctx->fp_mutex);
701 
702  /* report error outside of lock to avoid recursion */
703  if (r == -1) {
704  SCLogError("re-opening file \"%s\" failed: %s", op_iface_ctx->file,
705  strerror(errno));
706  }
707  }
708  break;
710  if (SCLogMessageGetBuffer(ts, 0, op_iface_ctx->type, buffer, sizeof(buffer),
711  op_iface_ctx->log_format ? op_iface_ctx->log_format
712  : sc_log_config->log_format,
713  log_level, file, line, function, module, message) == 0) {
714  SCLogPrintToSyslog(SCLogMapLogLevelToSyslogLevel(log_level), buffer);
715  }
716  break;
717  default:
718  break;
719  }
720  op_iface_ctx = op_iface_ctx->next;
721  }
722  return SC_OK;
723 }
724 
725 void SCLog(int x, const char *file, const char *func, const int line, const char *module,
726  const char *fmt, ...)
727 {
728  if (sc_log_global_log_level >= x &&
730  SCLogMatchFGFilterWL(file, func, line) == 1 ||
731  SCLogMatchFGFilterBL(file, func, line) == 1) &&
733  SCLogMatchFDFilter(func) == 1))
734  {
736  va_list ap;
737  va_start(ap, fmt);
738  vsnprintf(msg, sizeof(msg), fmt, ap);
739  va_end(ap);
740  SCLogMessage(x, file, line, func, module, msg);
741  }
742 }
743 
744 void SCLogErr(int x, const char *file, const char *func, const int line, const char *module,
745  const char *fmt, ...)
746 {
747  if (sc_log_global_log_level >= x &&
749  SCLogMatchFGFilterWL(file, func, line) == 1 ||
750  SCLogMatchFGFilterBL(file, func, line) == 1) &&
752  SCLogMatchFDFilter(func) == 1))
753  {
755  va_list ap;
756  va_start(ap, fmt);
757  vsnprintf(msg, sizeof(msg), fmt, ap);
758  va_end(ap);
759  SCLogMessage(x, file, line, func, module, msg);
760  }
761 }
762 
763 /**
764  * \brief Returns whether debug messages are enabled to be logged or not
765  *
766  * \retval 1 if debug messages are enabled to be logged
767  * \retval 0 if debug messages are not enabled to be logged
768  */
770 {
771 #ifdef DEBUG
773  return 1;
774  else
775  return 0;
776 #else
777  return 0;
778 #endif
779 }
780 
781 /**
782  * \brief Allocates an output buffer for an output interface. Used when we
783  * want the op_interface log_format to override the global_log_format.
784  * Currently not used.
785  *
786  * \retval buffer Pointer to the newly created output_buffer
787  */
789 {
790  SCLogOPBuffer *buffer = NULL;
791 
792  if ( (buffer = SCMalloc(sc_log_config->op_ifaces_cnt *
793  sizeof(SCLogOPBuffer))) == NULL) {
794  FatalError("Fatal error encountered in SCLogAllocLogOPBuffer. Exiting...");
795  }
796 
797  SCLogOPIfaceCtx *op_iface_ctx = sc_log_config->op_ifaces;
798  for (int i = 0; i < sc_log_config->op_ifaces_cnt; i++, op_iface_ctx = op_iface_ctx->next) {
799  buffer[i].log_format = op_iface_ctx->log_format;
800  buffer[i].temp = buffer[i].msg;
801  }
802 
803  return buffer;
804 }
805 
806 /*----------------------The logging module initialization code--------------- */
807 
808 /**
809  * \brief Returns a new output_interface_context
810  *
811  * \retval iface_ctx Pointer to a newly allocated output_interface_context
812  * \initonly
813  */
814 static inline SCLogOPIfaceCtx *SCLogAllocLogOPIfaceCtx(void)
815 {
816  SCLogOPIfaceCtx *iface_ctx = NULL;
817 
818  if ((iface_ctx = SCCalloc(1, sizeof(SCLogOPIfaceCtx))) == NULL) {
819  FatalError("Fatal error encountered in SCLogallocLogOPIfaceCtx. Exiting...");
820  }
821 
822  return iface_ctx;
823 }
824 
825 /**
826  * \brief Initializes the file output interface
827  *
828  * \param file Path to the file used for logging purposes
829  * \param log_format Pointer to the log_format for this op interface, that
830  * overrides the global_log_format
831  * \param log_level Override of the global_log_level by this interface
832  *
833  * \retval iface_ctx Pointer to the file output interface context created
834  * \initonly
835  */
836 static inline SCLogOPIfaceCtx *SCLogInitFileOPIface(const char *file, uint32_t userid,
837  uint32_t groupid, const char *log_format, int log_level, SCLogOPType type)
838 {
839  SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
840  if (iface_ctx == NULL) {
841  FatalError("Fatal error encountered in SCLogInitFileOPIface. Exiting...");
842  }
843 
844  if (file == NULL) {
845  goto error;
846  }
847 
848  iface_ctx->iface = SC_LOG_OP_IFACE_FILE;
849  iface_ctx->type = type;
850 
851  if ( (iface_ctx->file_d = fopen(file, "a")) == NULL) {
852  SCLogWarning("error opening file %s: %s", file, strerror(errno));
853  goto error;
854  }
855 
856 #ifndef OS_WIN32
857  if (userid != 0 || groupid != 0) {
858  if (fchown(fileno(iface_ctx->file_d), userid, groupid) == -1) {
859  SCLogWarning("Failed to change ownership of file %s: %s", file, strerror(errno));
860  }
861  }
862 #endif
863 
864  if ((iface_ctx->file = SCStrdup(file)) == NULL) {
865  goto error;
866  }
867 
868  if (log_format != NULL && (iface_ctx->log_format = SCStrdup(log_format)) == NULL) {
869  goto error;
870  }
871 
872  SCMutexInit(&iface_ctx->fp_mutex, NULL);
874 
875  iface_ctx->log_level = log_level;
876 
877  return iface_ctx;
878 
879 error:
880  if (iface_ctx->file != NULL) {
881  SCFree((char *)iface_ctx->file);
882  iface_ctx->file = NULL;
883  }
884  if (iface_ctx->log_format != NULL) {
885  SCFree((char *)iface_ctx->log_format);
886  iface_ctx->log_format = NULL;
887  }
888  if (iface_ctx->file_d != NULL) {
889  fclose(iface_ctx->file_d);
890  iface_ctx->file_d = NULL;
891  }
892  SCFree(iface_ctx);
893  return NULL;
894 }
895 
896 /**
897  * \brief Initializes the console output interface and deals with possible
898  * env var overrides.
899  *
900  * \param log_format Pointer to the log_format for this op interface, that
901  * overrides the global_log_format
902  * \param log_level Override of the global_log_level by this interface
903  *
904  * \retval iface_ctx Pointer to the console output interface context created
905  * \initonly
906  */
907 static inline SCLogOPIfaceCtx *SCLogInitConsoleOPIface(const char *log_format,
908  SCLogLevel log_level, SCLogOPType type)
909 {
910  SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
911 
912  if (iface_ctx == NULL) {
913  FatalError("Fatal error encountered in SCLogInitConsoleOPIface. Exiting...");
914  }
915 
916  iface_ctx->iface = SC_LOG_OP_IFACE_CONSOLE;
917  iface_ctx->type = type;
918 
919  /* console log format is overridden by envvars */
920  const char *tmp_log_format = log_format;
921  const char *s = getenv(SC_LOG_ENV_LOG_FORMAT);
922  if (s != NULL) {
923 #if 0
924  printf("Overriding setting for \"console.format\" because of env "
925  "var SC_LOG_FORMAT=\"%s\".\n", s);
926 #endif
927  tmp_log_format = s;
928  }
929 
930  if (tmp_log_format != NULL &&
931  (iface_ctx->log_format = SCStrdup(tmp_log_format)) == NULL) {
932  printf("Error allocating memory\n");
933  exit(EXIT_FAILURE);
934  }
935 
936  /* console log level is overridden by envvars */
937  SCLogLevel tmp_log_level = log_level;
938  s = getenv(SC_LOG_ENV_LOG_LEVEL);
939  if (s != NULL) {
941  if (l > SC_LOG_NOTSET && l < SC_LOG_LEVEL_MAX) {
942 #if 0
943  printf("Overriding setting for \"console.level\" because of env "
944  "var SC_LOG_LEVEL=\"%s\".\n", s);
945 #endif
946  tmp_log_level = l;
947  }
948  }
949  iface_ctx->log_level = tmp_log_level;
950 
951 #ifndef OS_WIN32
952  if (isatty(fileno(stdout)) && isatty(fileno(stderr))) {
953  iface_ctx->use_color = TRUE;
954  }
955 #endif
956 
957  return iface_ctx;
958 }
959 
960 /**
961  * \brief Initializes the syslog output interface
962  *
963  * \param facility The facility code for syslog
964  * \param log_format Pointer to the log_format for this op interface, that
965  * overrides the global_log_format
966  * \param log_level Override of the global_log_level by this interface
967  *
968  * \retval iface_ctx Pointer to the syslog output interface context created
969  */
970 static inline SCLogOPIfaceCtx *SCLogInitSyslogOPIface(int facility,
971  const char *log_format,
972  SCLogLevel log_level,
974 {
975  SCLogOPIfaceCtx *iface_ctx = SCLogAllocLogOPIfaceCtx();
976 
977  if ( iface_ctx == NULL) {
978  FatalError("Fatal error encountered in SCLogInitSyslogOPIface. Exiting...");
979  }
980 
981  iface_ctx->iface = SC_LOG_OP_IFACE_SYSLOG;
982  iface_ctx->type = type;
983 
984  if (facility == -1)
985  facility = SC_LOG_DEF_SYSLOG_FACILITY;
986  iface_ctx->facility = facility;
987 
988  if (log_format != NULL &&
989  (iface_ctx->log_format = SCStrdup(log_format)) == NULL) {
990  printf("Error allocating memory\n");
991  exit(EXIT_FAILURE);
992  }
993 
994  iface_ctx->log_level = log_level;
995 
996  openlog(NULL, LOG_NDELAY, iface_ctx->facility);
997 
998  return iface_ctx;
999 }
1000 
1001 /**
1002  * \brief Frees the output_interface context supplied as an argument
1003  *
1004  * \param iface_ctx Pointer to the op_interface_context to be freed
1005  */
1006 static inline void SCLogFreeLogOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx)
1007 {
1008  SCLogOPIfaceCtx *temp = NULL;
1009 
1010  while (iface_ctx != NULL) {
1011  temp = iface_ctx;
1012 
1013  if (iface_ctx->file_d != NULL) {
1014  fclose(iface_ctx->file_d);
1015  SCMutexDestroy(&iface_ctx->fp_mutex);
1016  }
1017 
1018  if (iface_ctx->file != NULL)
1019  SCFree((void *)iface_ctx->file);
1020 
1021  if (iface_ctx->log_format != NULL)
1022  SCFree((void *)iface_ctx->log_format);
1023 
1024  if (iface_ctx->iface == SC_LOG_OP_IFACE_SYSLOG) {
1025  closelog();
1026  }
1027 
1028  iface_ctx = iface_ctx->next;
1029 
1030  SCFree(temp);
1031  }
1032 
1033  return;
1034 }
1035 
1036 /**
1037  * \brief Internal function used to set the logging module global_log_level
1038  * during the initialization phase
1039  *
1040  * \param sc_lid The initialization data supplied.
1041  * \param sc_lc The logging module context which has to be updated.
1042  */
1043 static inline void SCLogSetLogLevel(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
1044 {
1045  SCLogLevel log_level = SC_LOG_NOTSET;
1046  const char *s = NULL;
1047 
1048  /* envvar overrides config */
1049  s = getenv(SC_LOG_ENV_LOG_LEVEL);
1050  if (s != NULL) {
1051  log_level = SCMapEnumNameToValue(s, sc_log_level_map);
1052  } else if (sc_lid != NULL) {
1053  log_level = sc_lid->global_log_level;
1054  }
1055 
1056  /* deal with the global_log_level to be used */
1057  if (log_level > SC_LOG_NOTSET && log_level < SC_LOG_LEVEL_MAX)
1058  sc_lc->log_level = log_level;
1059  else {
1061 #ifndef UNITTESTS
1062  if (sc_lid != NULL) {
1063  printf("Warning: Invalid/No global_log_level assigned by user. Falling "
1064  "back on the default_log_level \"%s\"\n",
1066  }
1067 #endif
1068  }
1069 
1070  /* we also set it to a global var, as it is easier to access it */
1072 
1073  return;
1074 }
1075 
1077 {
1078  return sc_log_global_log_level;
1079 }
1080 
1081 static inline const char *SCLogGetDefaultLogFormat(const SCLogLevel lvl)
1082 {
1083  const char *prog_ver = GetProgramVersion();
1084  if (strstr(prog_ver, "RELEASE") != NULL) {
1085  if (lvl <= SC_LOG_NOTICE)
1087  else if (lvl <= SC_LOG_INFO)
1089  else if (lvl <= SC_LOG_CONFIG)
1091  }
1093 }
1094 
1095 /**
1096  * \brief Internal function used to set the logging module global_log_format
1097  * during the initialization phase
1098  *
1099  * \param sc_lid The initialization data supplied.
1100  * \param sc_lc The logging module context which has to be updated.
1101  */
1102 static inline void SCLogSetLogFormat(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
1103 {
1104  const char *format = NULL;
1105 
1106  /* envvar overrides config */
1107  format = getenv(SC_LOG_ENV_LOG_FORMAT);
1108  if (format == NULL) {
1109  if (sc_lid != NULL) {
1110  format = sc_lid->global_log_format;
1111  }
1112  }
1113 
1114  /* deal with the global log format to be used */
1115  if (format == NULL || strlen(format) > SC_LOG_MAX_LOG_FORMAT_LEN) {
1116  format = SCLogGetDefaultLogFormat(sc_lc->log_level);
1117 #ifndef UNITTESTS
1118  if (sc_lid != NULL) {
1119  printf("Warning: Invalid/No global_log_format supplied by user or format "
1120  "length exceeded limit of \"%d\" characters. Falling back on "
1121  "default log_format \"%s\"\n", SC_LOG_MAX_LOG_FORMAT_LEN,
1122  format);
1123  }
1124 #endif
1125  }
1126 
1127  if (format != NULL && (sc_lc->log_format = SCStrdup(format)) == NULL) {
1128  printf("Error allocating memory\n");
1129  exit(EXIT_FAILURE);
1130  }
1131 
1132  return;
1133 }
1134 
1135 /**
1136  * \brief Internal function used to set the logging module global_op_ifaces
1137  * during the initialization phase
1138  *
1139  * \param sc_lid The initialization data supplied.
1140  * \param sc_lc The logging module context which has to be updated.
1141  */
1142 static inline void SCLogSetOPIface(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
1143 {
1144  SCLogOPIfaceCtx *op_ifaces_ctx = NULL;
1145  int op_iface = 0;
1146  const char *s = NULL;
1147 
1148  if (sc_lid != NULL && sc_lid->op_ifaces != NULL) {
1149  sc_lc->op_ifaces = sc_lid->op_ifaces;
1150  sc_lid->op_ifaces = NULL;
1151  sc_lc->op_ifaces_cnt = sc_lid->op_ifaces_cnt;
1152  } else {
1153  s = getenv(SC_LOG_ENV_LOG_OP_IFACE);
1154  if (s != NULL) {
1156 
1157  if(op_iface < 0 || op_iface >= SC_LOG_OP_IFACE_MAX) {
1158  op_iface = SC_LOG_DEF_LOG_OP_IFACE;
1159 #ifndef UNITTESTS
1160  printf("Warning: Invalid output interface supplied by user. "
1161  "Falling back on default_output_interface \"%s\"\n",
1163 #endif
1164  }
1165  }
1166  else {
1167  op_iface = SC_LOG_DEF_LOG_OP_IFACE;
1168 #ifndef UNITTESTS
1169  if (sc_lid != NULL) {
1170  printf("Warning: Output_interface not supplied by user. Falling "
1171  "back on default_output_interface \"%s\"\n",
1173  }
1174 #endif
1175  }
1176 
1177  switch (op_iface) {
1179  op_ifaces_ctx = SCLogInitConsoleOPIface(NULL, SC_LOG_LEVEL_MAX,0);
1180  break;
1181  case SC_LOG_OP_IFACE_FILE:
1182  s = getenv(SC_LOG_ENV_LOG_FILE);
1183  if (s == NULL) {
1184  char *str = SCLogGetLogFilename(SC_LOG_DEF_LOG_FILE);
1185  if (str != NULL) {
1186  op_ifaces_ctx = SCLogInitFileOPIface(str, 0, 0, NULL, SC_LOG_LEVEL_MAX, 0);
1187  SCFree(str);
1188  }
1189  } else {
1190  op_ifaces_ctx = SCLogInitFileOPIface(s, 0, 0, NULL, SC_LOG_LEVEL_MAX, 0);
1191  }
1192  break;
1194  s = getenv(SC_LOG_ENV_LOG_FACILITY);
1195  if (s == NULL)
1197 
1198  op_ifaces_ctx = SCLogInitSyslogOPIface(SCMapEnumNameToValue(s, SCSyslogGetFacilityMap()), NULL, -1,0);
1199  break;
1200  }
1201  sc_lc->op_ifaces = op_ifaces_ctx;
1202  sc_lc->op_ifaces_cnt++;
1203  }
1204  return;
1205 }
1206 
1207 /**
1208  * \brief Internal function used to set the logging module op_filter
1209  * during the initialization phase
1210  *
1211  * \param sc_lid The initialization data supplied.
1212  * \param sc_lc The logging module context which has to be updated.
1213  */
1214 static inline void SCLogSetOPFilter(SCLogInitData *sc_lid, SCLogConfig *sc_lc)
1215 {
1216  const char *filter = NULL;
1217 
1218  int opts = 0;
1219  int en;
1220  PCRE2_SIZE eo = 0;
1221 
1222  /* envvar overrides */
1223  filter = getenv(SC_LOG_ENV_LOG_OP_FILTER);
1224  if (filter == NULL) {
1225  if (sc_lid != NULL) {
1226  filter = sc_lid->op_filter;
1227  }
1228  }
1229 
1230  if (filter != NULL && strcmp(filter, "") != 0) {
1231  sc_lc->op_filter = SCStrdup(filter);
1232  if (sc_lc->op_filter == NULL) {
1233  printf("pcre filter alloc failed\n");
1234  return;
1235  }
1236  sc_lc->op_filter_regex =
1237  pcre2_compile((PCRE2_SPTR8)filter, PCRE2_ZERO_TERMINATED, opts, &en, &eo, NULL);
1238  if (sc_lc->op_filter_regex == NULL) {
1239  SCFree(sc_lc->op_filter);
1240  PCRE2_UCHAR errbuffer[256];
1241  pcre2_get_error_message(en, errbuffer, sizeof(errbuffer));
1242  printf("pcre2 compile of \"%s\" failed at offset %d : %s\n", filter, (int)eo,
1243  errbuffer);
1244  return;
1245  }
1246  sc_lc->op_filter_regex_match =
1247  pcre2_match_data_create_from_pattern(sc_lc->op_filter_regex, NULL);
1248  }
1249 
1250  return;
1251 }
1252 
1253 /**
1254  * \brief Returns a pointer to a new SCLogInitData. This is a public interface
1255  * intended to be used after the logging parameters are read from the
1256  * conf file
1257  *
1258  * \retval sc_lid Pointer to the newly created SCLogInitData
1259  * \initonly
1260  */
1262 {
1263  SCLogInitData *sc_lid = NULL;
1264 
1265  if ((sc_lid = SCCalloc(1, sizeof(SCLogInitData))) == NULL)
1266  return NULL;
1267 
1268  return sc_lid;
1269 }
1270 
1271 #ifdef UNITTESTS
1272 #ifndef OS_WIN32
1273 /**
1274  * \brief Frees a SCLogInitData
1275  *
1276  * \param sc_lid Pointer to the SCLogInitData to be freed
1277  */
1278 static void SCLogFreeLogInitData(SCLogInitData *sc_lid)
1279 {
1280  if (sc_lid != NULL) {
1281  SCLogFreeLogOPIfaceCtx(sc_lid->op_ifaces);
1282  SCFree(sc_lid);
1283  }
1284 
1285  return;
1286 }
1287 #endif
1288 #endif
1289 
1290 /**
1291  * \brief Frees the logging module context
1292  */
1293 static inline void SCLogFreeLogConfig(SCLogConfig *sc_lc)
1294 {
1295  if (sc_lc != NULL) {
1296  if (sc_lc->startup_message != NULL)
1297  SCFree(sc_lc->startup_message);
1298  if (sc_lc->log_format != NULL)
1299  SCFree(sc_lc->log_format);
1300  if (sc_lc->op_filter != NULL)
1301  SCFree(sc_lc->op_filter);
1302 
1303  if (sc_lc->op_filter_regex != NULL)
1304  pcre2_code_free(sc_lc->op_filter_regex);
1305  if (sc_lc->op_filter_regex_match)
1306  pcre2_match_data_free(sc_lc->op_filter_regex_match);
1307 
1308  SCLogFreeLogOPIfaceCtx(sc_lc->op_ifaces);
1309  SCFree(sc_lc);
1310  }
1311 
1312  return;
1313 }
1314 
1315 /**
1316  * \brief Appends an output_interface to the output_interface list sent in head
1317  *
1318  * \param iface_ctx Pointer to the output_interface that has to be added to head
1319  * \param head Pointer to the output_interface list
1320  */
1322 {
1323  SCLogOPIfaceCtx *temp = NULL, *prev = NULL;
1324  SCLogOPIfaceCtx **head = &sc_lid->op_ifaces;
1325 
1326  if (iface_ctx == NULL) {
1327 #ifdef DEBUG
1328  printf("Argument(s) to SCLogAppendOPIfaceCtx() NULL\n");
1329 #endif
1330  return;
1331  }
1332 
1333  temp = *head;
1334  while (temp != NULL) {
1335  prev = temp;
1336  temp = temp->next;
1337  }
1338 
1339  if (prev == NULL)
1340  *head = iface_ctx;
1341  else
1342  prev->next = iface_ctx;
1343 
1344  sc_lid->op_ifaces_cnt++;
1345 
1346  return;
1347 }
1348 
1349 #ifdef UNITTESTS
1350 #ifndef OS_WIN32
1351 /**
1352  * \internal
1353  * \brief Creates a new output interface based on the arguments sent. The kind
1354  * of output interface to be created is decided by the iface_name arg.
1355  * If iface_name is "file", the arg argument will hold the filename to be
1356  * used for logging purposes. If iface_name is "syslog", the arg
1357  * argument holds the facility code. If iface_name is "console", arg is
1358  * NULL.
1359  *
1360  * \param iface_name Interface name. Can be "console", "file" or "syslog"
1361  * \param log_format Override for the global_log_format
1362  * \param log_level Override for the global_log_level
1363  * \param log_level Parameter required by a particular interface. Explained in
1364  * the function description
1365  *
1366  * \retval iface_ctx Pointer to the newly created output interface
1367  */
1368 static SCLogOPIfaceCtx *SCLogInitOPIfaceCtx(
1369  const char *iface_name, const char *log_format, int log_level, const char *arg)
1370 {
1371  int iface = SCMapEnumNameToValue(iface_name, sc_log_op_iface_map);
1372 
1373  if (log_level < SC_LOG_NONE || log_level > SC_LOG_DEBUG) {
1374  printf("Warning: Supplied log_level_override for op_interface \"%s\" "
1375  "is invalid. Defaulting to not specifying an override\n",
1376  iface_name);
1377  log_level = SC_LOG_NOTSET;
1378  }
1379 
1380  switch (iface) {
1382  return SCLogInitConsoleOPIface(log_format, log_level, SC_LOG_OP_TYPE_REGULAR);
1383  case SC_LOG_OP_IFACE_FILE:
1384  return SCLogInitFileOPIface(arg, 0, 0, log_format, log_level, SC_LOG_OP_TYPE_REGULAR);
1386  return SCLogInitSyslogOPIface(SCMapEnumNameToValue(arg, SCSyslogGetFacilityMap()),
1387  log_format, log_level, SC_LOG_OP_TYPE_REGULAR);
1388  default:
1389 #ifdef DEBUG
1390  printf("Output Interface \"%s\" not supported by the logging module",
1391  iface_name);
1392 #endif
1393  return NULL;
1394  }
1395 }
1396 #endif
1397 #endif
1398 
1399 /**
1400  * \brief Initializes the logging module.
1401  *
1402  * \param sc_lid The initialization data for the logging module. If sc_lid is
1403  * NULL, we would stick to the default configuration for the
1404  * logging subsystem.
1405  * \initonly
1406  */
1408 {
1409  /* De-initialize the logging context, if it has already init by the
1410  * environment variables at the start of the engine */
1412 
1413 #if defined (OS_WIN32)
1414  if (SCMutexInit(&sc_log_stream_lock, NULL) != 0) {
1415  FatalError("Failed to initialize log mutex.");
1416  }
1417 #endif /* OS_WIN32 */
1418 
1419  /* sc_log_config is a global variable */
1420  if ((sc_log_config = SCCalloc(1, sizeof(SCLogConfig))) == NULL) {
1421  FatalError("Fatal error encountered in SCLogInitLogModule. Exiting...");
1422  }
1423 
1424  SCLogSetLogLevel(sc_lid, sc_log_config);
1425  SCLogSetLogFormat(sc_lid, sc_log_config);
1426  SCLogSetOPIface(sc_lid, sc_log_config);
1427  SCLogSetOPFilter(sc_lid, sc_log_config);
1428 
1431 
1432  //SCOutputPrint(sc_did->startup_message);
1433 
1434  rs_log_set_level(sc_log_global_log_level);
1435  return;
1436 }
1437 
1438 void SCLogLoadConfig(int daemon, int verbose, uint32_t userid, uint32_t groupid)
1439 {
1440  ConfNode *outputs;
1441  SCLogInitData *sc_lid;
1442  int have_logging = 0;
1443  int max_level = 0;
1444  SCLogLevel min_level = 0;
1445 
1446  /* If verbose logging was requested, set the minimum as
1447  * SC_LOG_NOTICE plus the extra verbosity. */
1448  if (verbose) {
1449  min_level = SC_LOG_NOTICE + verbose;
1450  }
1451 
1452  outputs = ConfGetNode("logging.outputs");
1453  if (outputs == NULL) {
1454  SCLogDebug("No logging.output configuration section found.");
1455  return;
1456  }
1457 
1458  sc_lid = SCLogAllocLogInitData();
1459  if (sc_lid == NULL) {
1460  SCLogDebug("Could not allocate memory for log init data");
1461  return;
1462  }
1463 
1464  /* Get default log level and format. */
1465  const char *default_log_level_s = NULL;
1466  if (ConfGet("logging.default-log-level", &default_log_level_s) == 1) {
1467  SCLogLevel default_log_level =
1468  SCMapEnumNameToValue(default_log_level_s, sc_log_level_map);
1469  if (default_log_level == -1) {
1470  SCLogError("Invalid default log level: %s", default_log_level_s);
1471  exit(EXIT_FAILURE);
1472  }
1473  sc_lid->global_log_level = MAX(min_level, default_log_level);
1474  }
1475  else {
1476  sc_lid->global_log_level = MAX(min_level, SC_LOG_NOTICE);
1477  }
1478 
1479  if (ConfGet("logging.default-log-format", &sc_lid->global_log_format) != 1)
1480  sc_lid->global_log_format = SCLogGetDefaultLogFormat(sc_lid->global_log_level);
1481 
1482  (void)ConfGet("logging.default-output-filter", &sc_lid->op_filter);
1483 
1484  ConfNode *seq_node, *output;
1485  TAILQ_FOREACH(seq_node, &outputs->head, next) {
1486  SCLogLevel level = sc_lid->global_log_level;
1487  SCLogOPIfaceCtx *op_iface_ctx = NULL;
1488  const char *format;
1489  const char *level_s;
1490 
1491  output = ConfNodeLookupChild(seq_node, seq_node->val);
1492  if (output == NULL)
1493  continue;
1494 
1495  /* By default an output is enabled. */
1496  const char *enabled = ConfNodeLookupChildValue(output, "enabled");
1497  if (enabled != NULL && ConfValIsFalse(enabled))
1498  continue;
1499 
1501  const char *type_s = ConfNodeLookupChildValue(output, "type");
1502  if (type_s != NULL) {
1503  if (strcmp(type_s, "regular") == 0)
1505  else if (strcmp(type_s, "json") == 0) {
1507  }
1508  }
1509 
1510  format = ConfNodeLookupChildValue(output, "format");
1511 
1512  level_s = ConfNodeLookupChildValue(output, "level");
1513  if (level_s != NULL) {
1514  level = SCMapEnumNameToValue(level_s, sc_log_level_map);
1515  if (level == -1) {
1516  SCLogError("Invalid log level: %s", level_s);
1517  exit(EXIT_FAILURE);
1518  }
1519  max_level = MAX(max_level, level);
1520  }
1521 
1522  /* Increase the level of extra verbosity was requested. */
1523  level = MAX(min_level, level);
1524 
1525  if (strcmp(output->name, "console") == 0) {
1526  op_iface_ctx = SCLogInitConsoleOPIface(format, level, type);
1527  }
1528  else if (strcmp(output->name, "file") == 0) {
1529  if (format == NULL) {
1530  format = SC_LOG_DEF_FILE_FORMAT;
1531  }
1532 
1533  const char *filename = ConfNodeLookupChildValue(output, "filename");
1534  if (filename == NULL) {
1535  FatalError("Logging to file requires a filename");
1536  }
1537  char *path = NULL;
1538  if (!(PathIsAbsolute(filename))) {
1539  path = SCLogGetLogFilename(filename);
1540  } else {
1541  path = SCStrdup(filename);
1542  }
1543  if (path == NULL)
1544  FatalError("failed to setup output to file");
1545  have_logging = 1;
1546  op_iface_ctx = SCLogInitFileOPIface(path, userid, groupid, format, level, type);
1547  SCFree(path);
1548  }
1549  else if (strcmp(output->name, "syslog") == 0) {
1550  int facility = SC_LOG_DEF_SYSLOG_FACILITY;
1551  const char *facility_s = ConfNodeLookupChildValue(output,
1552  "facility");
1553  if (facility_s != NULL) {
1554  facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap());
1555  if (facility == -1) {
1556  SCLogWarning("Invalid syslog "
1557  "facility: \"%s\", now using \"%s\" as syslog "
1558  "facility",
1559  facility_s, SC_LOG_DEF_SYSLOG_FACILITY_STR);
1560  facility = SC_LOG_DEF_SYSLOG_FACILITY;
1561  }
1562  }
1563  SCLogDebug("Initializing syslog logging with format \"%s\"", format);
1564  have_logging = 1;
1565  op_iface_ctx = SCLogInitSyslogOPIface(facility, format, level, type);
1566  }
1567  else {
1568  SCLogWarning("invalid logging method: %s, ignoring", output->name);
1569  }
1570  if (op_iface_ctx != NULL) {
1571  SCLogAppendOPIfaceCtx(op_iface_ctx, sc_lid);
1572  }
1573  }
1574 
1575  if (daemon && (have_logging == 0)) {
1576  SCLogWarning("no logging compatible with daemon mode selected,"
1577  " suricata won't be able to log. Please update "
1578  " 'logging.outputs' in the YAML.");
1579  }
1580 
1581  /* Set the global log level to that of the max level used. */
1582  sc_lid->global_log_level = MAX(sc_lid->global_log_level, max_level);
1583  SCLogInitLogModule(sc_lid);
1584 
1585  SCLogDebug("sc_log_global_log_level: %d", sc_log_global_log_level);
1586  SCLogDebug("sc_lc->log_format: %s", sc_log_config->log_format);
1587  SCLogDebug("SCLogSetOPFilter: filter: %s", sc_log_config->op_filter);
1588 
1589  if (sc_lid != NULL)
1590  SCFree(sc_lid);
1591 }
1592 
1593 /**
1594  * \brief Returns a full file path given a filename uses log dir specified in
1595  * conf or DEFAULT_LOG_DIR
1596  *
1597  * \param filearg The relative filename for which we want a full path include
1598  * log directory
1599  *
1600  * \retval log_filename The fullpath of the logfile to open
1601  */
1602 static char *SCLogGetLogFilename(const char *filearg)
1603 {
1604  const char *log_dir = ConfigGetLogDirectory();
1605  char *log_filename = SCMalloc(PATH_MAX);
1606  if (unlikely(log_filename == NULL))
1607  return NULL;
1608  snprintf(log_filename, PATH_MAX, "%s/%s", log_dir, filearg);
1609  return log_filename;
1610 }
1611 
1612 /**
1613  * \brief De-Initializes the logging module
1614  */
1616 {
1617  SCLogFreeLogConfig(sc_log_config);
1618 
1619  /* reset the global logging_module variables */
1623  sc_log_config = NULL;
1624 
1625  /* de-init the FD filters */
1627  /* de-init the FG filters */
1629 
1630 #if defined (OS_WIN32)
1631  SCMutexDestroy(&sc_log_stream_lock);
1632 #endif /* OS_WIN32 */
1633 
1634  return;
1635 }
1636 
1637 //------------------------------------Unit_Tests--------------------------------
1638 
1639 /* The logging engine should be tested to the maximum extent possible, since
1640  * logging code would be used throughout the codebase, and hence we can't afford
1641  * to have a single bug here(not that you can afford to have a bug
1642  * elsewhere ;) ). Please report a bug, if you get a slightest hint of a bug
1643  * from the logging module.
1644  */
1645 
1646 #ifdef UNITTESTS
1647 
1648 static int SCLogTestInit01(void)
1649 {
1650 #ifndef OS_WIN32
1651  /* unset any environment variables set for the logging module */
1655 
1656  SCLogInitLogModule(NULL);
1657 
1658  FAIL_IF_NULL(sc_log_config);
1659 
1660  FAIL_IF_NOT(SC_LOG_DEF_LOG_LEVEL == sc_log_config->log_level);
1661  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1662  SC_LOG_DEF_LOG_OP_IFACE == sc_log_config->op_ifaces->iface);
1663  FAIL_IF_NOT(sc_log_config->log_format != NULL &&
1664  strcmp(SCLogGetDefaultLogFormat(sc_log_config->log_level),
1665  sc_log_config->log_format) == 0);
1666 
1668 
1669  setenv(SC_LOG_ENV_LOG_LEVEL, "Debug", 1);
1670  setenv(SC_LOG_ENV_LOG_OP_IFACE, "Console", 1);
1671  setenv(SC_LOG_ENV_LOG_FORMAT, "%n- %l", 1);
1672 
1673  SCLogInitLogModule(NULL);
1674 
1675  FAIL_IF_NOT(SC_LOG_DEBUG == sc_log_config->log_level);
1676  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1677  SC_LOG_OP_IFACE_CONSOLE == sc_log_config->op_ifaces->iface);
1678  FAIL_IF_NOT(sc_log_config->log_format != NULL &&
1679  !strcmp("%n- %l", sc_log_config->log_format));
1680 
1684 
1686 #endif
1687  PASS;
1688 }
1689 
1690 static int SCLogTestInit02(void)
1691 {
1692 #ifndef OS_WIN32
1693  SCLogInitData *sc_lid = NULL;
1694  SCLogOPIfaceCtx *sc_iface_ctx = NULL;
1695  char *logfile = SCLogGetLogFilename("boo.txt");
1696  sc_lid = SCLogAllocLogInitData();
1697  FAIL_IF_NULL(sc_lid);
1698  sc_lid->startup_message = "Test02";
1699  sc_lid->global_log_level = SC_LOG_DEBUG;
1700  sc_lid->op_filter = "boo";
1701  sc_iface_ctx = SCLogInitOPIfaceCtx("file", "%m - %d", SC_LOG_WARNING, logfile);
1702  SCLogAppendOPIfaceCtx(sc_iface_ctx, sc_lid);
1703  sc_iface_ctx = SCLogInitOPIfaceCtx("console", NULL, SC_LOG_ERROR,
1704  NULL);
1705  SCLogAppendOPIfaceCtx(sc_iface_ctx, sc_lid);
1706 
1707  SCLogInitLogModule(sc_lid);
1708 
1709  FAIL_IF_NULL(sc_log_config);
1710 
1711  FAIL_IF_NOT(SC_LOG_DEBUG == sc_log_config->log_level);
1712  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1713  SC_LOG_OP_IFACE_FILE == sc_log_config->op_ifaces->iface);
1714  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1715  sc_log_config->op_ifaces->next != NULL &&
1716  SC_LOG_OP_IFACE_CONSOLE == sc_log_config->op_ifaces->next->iface);
1717  FAIL_IF_NOT(sc_log_config->log_format != NULL &&
1718  strcmp(SCLogGetDefaultLogFormat(sc_log_config->log_level),
1719  sc_log_config->log_format) == 0);
1720  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1721  sc_log_config->op_ifaces->log_format != NULL &&
1722  strcmp("%m - %d", sc_log_config->op_ifaces->log_format) == 0);
1723  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1724  sc_log_config->op_ifaces->next != NULL &&
1725  sc_log_config->op_ifaces->next->log_format == NULL);
1726 
1727  SCLogFreeLogInitData(sc_lid);
1729 
1730  sc_lid = SCLogAllocLogInitData();
1731  FAIL_IF_NULL(sc_lid);
1732  sc_lid->startup_message = "Test02";
1733  sc_lid->global_log_level = SC_LOG_DEBUG;
1734  sc_lid->op_filter = "boo";
1735  sc_lid->global_log_format = "kaboo";
1736 
1737  SCLogInitLogModule(sc_lid);
1738 
1739  FAIL_IF_NULL(sc_log_config);
1740 
1741  FAIL_IF_NOT(SC_LOG_DEBUG == sc_log_config->log_level);
1742  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1743  SC_LOG_OP_IFACE_CONSOLE == sc_log_config->op_ifaces->iface);
1744  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1745  sc_log_config->op_ifaces->next == NULL);
1746  FAIL_IF_NOT(sc_log_config->log_format != NULL &&
1747  strcmp("kaboo", sc_log_config->log_format) == 0);
1748  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1749  sc_log_config->op_ifaces->log_format == NULL);
1750  FAIL_IF_NOT(sc_log_config->op_ifaces != NULL &&
1751  sc_log_config->op_ifaces->next == NULL);
1752 
1753  SCLogFreeLogInitData(sc_lid);
1755  SCFree(logfile);
1756 #endif
1757  PASS;
1758 }
1759 
1760 static int SCLogTestInit03(void)
1761 {
1762  SCLogInitLogModule(NULL);
1763 
1764  SCLogAddFGFilterBL(NULL, "bamboo", -1);
1765  SCLogAddFGFilterBL(NULL, "soo", -1);
1766  SCLogAddFGFilterBL(NULL, "dummy", -1);
1767 
1769 
1770  SCLogAddFGFilterBL(NULL, "dummy1", -1);
1771  SCLogAddFGFilterBL(NULL, "dummy2", -1);
1772 
1774 
1776 
1777  PASS;
1778 }
1779 
1780 static int SCLogTestInit04(void)
1781 {
1782  SCLogInitLogModule(NULL);
1783 
1784  SCLogAddFDFilter("bamboo");
1785  SCLogAddFDFilter("soo");
1786  SCLogAddFDFilter("foo");
1787  SCLogAddFDFilter("roo");
1788 
1790 
1791  SCLogAddFDFilter("loo");
1792  SCLogAddFDFilter("soo");
1793 
1795 
1796  SCLogRemoveFDFilter("bamboo");
1797  SCLogRemoveFDFilter("soo");
1798  SCLogRemoveFDFilter("foo");
1799  SCLogRemoveFDFilter("noo");
1800 
1802 
1804 
1805  PASS;
1806 }
1807 
1808 static int SCLogTestInit05(void)
1809 {
1810  char str[4096];
1811  memset(str, 'A', sizeof(str));
1812  SCLogInfo("%s", str);
1813 
1814  PASS;
1815 }
1816 
1817 #endif /* UNITTESTS */
1818 
1820 {
1821 
1822 #ifdef UNITTESTS
1823 
1824  UtRegisterTest("SCLogTestInit01", SCLogTestInit01);
1825  UtRegisterTest("SCLogTestInit02", SCLogTestInit02);
1826  UtRegisterTest("SCLogTestInit03", SCLogTestInit03);
1827  UtRegisterTest("SCLogTestInit04", SCLogTestInit04);
1828  UtRegisterTest("SCLogTestInit05", SCLogTestInit05);
1829 
1830 #endif /* UNITTESTS */
1831 
1832  return;
1833 }
SC_LOG_DEF_SYSLOG_FACILITY
#define SC_LOG_DEF_SYSLOG_FACILITY
Definition: util-debug.h:100
SCLogConfig_::op_ifaces
SCLogOPIfaceCtx * op_ifaces
Definition: util-debug.h:181
ts
uint64_t ts
Definition: source-erf-file.c:55
SCLogMatchFGFilterBL
int SCLogMatchFGFilterBL(const char *file, const char *function, int line)
Checks if there is a match for the incoming log_message with any of the FG filters....
Definition: util-debug-filters.c:312
SC_LOG_DEF_SYSLOG_FACILITY_STR
#define SC_LOG_DEF_SYSLOG_FACILITY_STR
Definition: util-debug.h:99
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SC_LOG_FMT_MESSAGE
#define SC_LOG_FMT_MESSAGE
Definition: util-debug.h:199
SCLogConfig_::op_filter_regex_match
pcre2_match_data * op_filter_regex_match
Definition: util-debug.h:178
SCLog
void SCLog(int x, const char *file, const char *func, const int line, const char *module, const char *fmt,...)
Definition: util-debug.c:725
SCLogInitLogModule
void SCLogInitLogModule(SCLogInitData *sc_lid)
Initializes the logging module.
Definition: util-debug.c:1407
syslog
#define syslog(__pri, __fmt, __param)
Definition: win32-syslog.h:78
SCLogOPIfaceCtx_::log_level
SCLogLevel log_level
Definition: util-debug.h:133
sc_log_level_map
SCEnumCharMap sc_log_level_map[]
Definition: util-debug.c:41
CreateIsoTimeString
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
Definition: util-time.c:209
SCLogOPIfaceCtx_::facility
int facility
Definition: util-debug.h:130
SC_LOG_DEBUG
@ SC_LOG_DEBUG
Definition: util-debug.h:57
sc_log_fg_filters_present
int sc_log_fg_filters_present
Definition: util-debug-filters.c:36
ConfNode_::val
char * val
Definition: conf.h:34
unsetenv
void unsetenv(const char *name)
SC_LOG_OP_TYPE_REGULAR
@ SC_LOG_OP_TYPE_REGULAR
Definition: util-debug.h:72
SC_LOG_CONFIG
@ SC_LOG_CONFIG
Definition: util-debug.h:56
SCLogAllocLogOPBuffer
SCLogOPBuffer * SCLogAllocLogOPBuffer(void)
Allocates an output buffer for an output interface. Used when we want the op_interface log_format to ...
Definition: util-debug.c:788
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_LOG_NOTSET
@ SC_LOG_NOTSET
Definition: util-debug.h:49
SC_LOG_FMT_PREFIX
#define SC_LOG_FMT_PREFIX
Definition: util-debug.h:202
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SC_LOG_FMT_FILE_NAME
#define SC_LOG_FMT_FILE_NAME
Definition: util-debug.h:194
SCLogInitData_::global_log_format
const char * global_log_format
Definition: util-debug.h:156
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
SC_LOG_OP_TYPE_JSON
@ SC_LOG_OP_TYPE_JSON
Definition: util-debug.h:73
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
SCLogOPBuffer_
Structure to be used when log_level override support would be provided by the logging module.
Definition: util-debug.h:106
SCLogOPIfaceCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-debug.h:139
SC_LOG_ENV_LOG_OP_IFACE
#define SC_LOG_ENV_LOG_OP_IFACE
Definition: util-debug.h:37
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
SCLogConfig_::op_filter
char * op_filter
Definition: util-debug.h:175
util-syslog.h
SC_LOG_ENV_LOG_FACILITY
#define SC_LOG_ENV_LOG_FACILITY
Definition: util-debug.h:39
SC_LOG_DEF_LOG_FORMAT_DEBUG
#define SC_LOG_DEF_LOG_FORMAT_DEBUG
Definition: util-debug.h:81
SCLogDeInitLogModule
void SCLogDeInitLogModule(void)
De-Initializes the logging module.
Definition: util-debug.c:1615
LOG_DEBUG
#define LOG_DEBUG
Definition: win32-syslog.h:46
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
sc_log_module_initialized
int sc_log_module_initialized
Used to indicate whether the logging module has been init or not.
Definition: util-debug.c:106
SC_LOG_NOTICE
@ SC_LOG_NOTICE
Definition: util-debug.h:53
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
SC_LOG_DEF_LOG_OP_IFACE
#define SC_LOG_DEF_LOG_OP_IFACE
Definition: util-debug.h:93
MIN
#define MIN(x, y)
Definition: suricata-common.h:380
SCLogOPIfaceCtx_::log_format
const char * log_format
Definition: util-debug.h:136
SCLogInitData_
Structure containing init data, that would be passed to SCInitDebugModule()
Definition: util-debug.h:148
SC_LOG_FMT_TIME_LEGACY
#define SC_LOG_FMT_TIME_LEGACY
Definition: util-debug.h:188
SC_LOG_FMT_LOG_LEVEL
#define SC_LOG_FMT_LOG_LEVEL
Definition: util-debug.h:192
SCLogOPType
SCLogOPType
Definition: util-debug.h:71
MAX
#define MAX(x, y)
Definition: suricata-common.h:384
SCLogMatchFDFilter
int SCLogMatchFDFilter(const char *function)
Checks if there is a match for the incoming log_message with any of the FD filters.
Definition: util-debug-filters.c:479
SCLogOPIfaceCtx_::type
SCLogOPType type
Definition: util-debug.h:119
SC_LOG_LEVEL_MAX
@ SC_LOG_LEVEL_MAX
Definition: util-debug.h:58
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
closelog
#define closelog()
Definition: win32-syslog.h:75
t_thread_name
thread_local char t_thread_name[THREAD_NAME_LEN+1]
Definition: threads.c:32
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
SCLogReleaseFGFilters
void SCLogReleaseFGFilters(void)
Definition: util-debug-filters.c:359
SC_LOG_DEF_LOG_FORMAT_REL_INFO
#define SC_LOG_DEF_LOG_FORMAT_REL_INFO
Definition: util-debug.h:79
SCLogOPIfaceCtx_
The output interface context for the logging module.
Definition: util-debug.h:115
OutputRegisterFileRotationFlag
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:831
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
SC_LOG_INFO
@ SC_LOG_INFO
Definition: util-debug.h:54
SC_LOG_ERROR
@ SC_LOG_ERROR
Definition: util-debug.h:51
SC_LOG_ENV_LOG_LEVEL
#define SC_LOG_ENV_LOG_LEVEL
ENV vars that can be used to set the properties for the logging module.
Definition: util-debug.h:36
util-debug.h
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:38
type
uint8_t type
Definition: decode-icmpv4.h:0
SCLogReleaseFDFilters
void SCLogReleaseFDFilters(void)
Releases all the FD filters added to the logging module.
Definition: util-debug-filters.c:725
SC_LOG_FMT_THREAD_NAME
#define SC_LOG_FMT_THREAD_NAME
Definition: util-debug.h:198
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
SCLogConfig_::op_filter_regex
pcre2_code * op_filter_regex
Definition: util-debug.h:177
SCLogOPIfaceCtx_::use_color
int16_t use_color
Definition: util-debug.h:118
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
SCSyslogGetFacilityMap
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:57
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
SCLogConfig_::op_ifaces_cnt
uint8_t op_ifaces_cnt
Definition: util-debug.h:183
LOG_NOTICE
#define LOG_NOTICE
Definition: win32-syslog.h:44
SCLogConfig_::log_level
SCLogLevel log_level
Definition: util-debug.h:172
SC_LOG_OP_IFACE_MAX
@ SC_LOG_OP_IFACE_MAX
Definition: util-debug.h:68
SCLogOPIfaceCtx_::iface
SCLogOPIface iface
Definition: util-debug.h:116
util-time.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
SCLogErr
void SCLogErr(int x, const char *file, const char *func, const int line, const char *module, const char *fmt,...)
Definition: util-debug.c:744
GetProgramVersion
const char * GetProgramVersion(void)
get string with program version
Definition: suricata.c:1126
TRUE
#define TRUE
Definition: suricata-common.h:33
SCLogOPBuffer_::log_format
const char * log_format
Definition: util-debug.h:109
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
SCLogOPIfaceCtx_::file
const char * file
Definition: util-debug.h:122
SC_LOG_ENV_LOG_FILE
#define SC_LOG_ENV_LOG_FILE
Definition: util-debug.h:38
SCLocalTime
struct tm * SCLocalTime(time_t timep, struct tm *result)
Definition: util-time.c:267
SCLogMatchFGFilterWL
int SCLogMatchFGFilterWL(const char *file, const char *function, int line)
Checks if there is a match for the incoming log_message with any of the FG filters....
Definition: util-debug-filters.c:294
TimeGet
SCTime_t TimeGet(void)
Definition: util-time.c:152
sc_log_module_cleaned
int sc_log_module_cleaned
Used to indicate whether the logging module has been cleaned or not.
Definition: util-debug.c:111
SCLogConfig_::startup_message
char * startup_message
Definition: util-debug.h:171
SCLogOPBuffer_::msg
char msg[SC_LOG_MAX_LOG_MSG_LEN]
Definition: util-debug.h:107
SCLogInitData_::global_log_level
SCLogLevel global_log_level
Definition: util-debug.h:153
SC_OK
@ SC_OK
Definition: util-error.h:29
SCTime_t
Definition: util-time.h:40
SCLogRegisterTests
void SCLogRegisterTests(void)
Definition: util-debug.c:1819
SC_LOG_DEF_LOG_FILE
#define SC_LOG_DEF_LOG_FILE
Definition: util-debug.h:96
SC_LOG_OP_IFACE_FILE
@ SC_LOG_OP_IFACE_FILE
Definition: util-debug.h:66
setenv
void setenv(const char *name, const char *value, int overwrite)
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
SCLogLevel
SCLogLevel
The various log levels NOTE: when adding new level, don't forget to update SCLogMapLogLevelToSyslogLe...
Definition: util-debug.h:48
SCMutexInit
#define SCMutexInit(mut, mutattrs)
Definition: threads-debug.h:116
LOG_EMERG
#define LOG_EMERG
Definition: win32-syslog.h:39
SC_LOG_WARNING
@ SC_LOG_WARNING
Definition: util-debug.h:52
SCLogInitData_::op_filter
const char * op_filter
Definition: util-debug.h:159
SC_LOG_MAX_LOG_FORMAT_LEN
#define SC_LOG_MAX_LOG_FORMAT_LEN
Definition: util-debug.h:87
SCGetThreadIdLong
#define SCGetThreadIdLong(...)
Definition: threads.h:255
sc_log_op_iface_map
SCEnumCharMap sc_log_op_iface_map[]
Definition: util-debug.c:68
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:780
SC_LOG_FMT_SUBSYSTEM
#define SC_LOG_FMT_SUBSYSTEM
Definition: util-debug.h:197
util-conf.h
SCMapEnumValueToName
const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table)
Maps an enum value to a string name, from the supplied table.
Definition: util-enum.c:68
SCLogPrintFDFilters
int SCLogPrintFDFilters(void)
Prints the FG filters(both WL and BL). Used for debugging purposes.
Definition: util-debug-filters.c:814
SCMapEnumNameToValue
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:40
SCLogMessage
SCError SCLogMessage(const SCLogLevel log_level, const char *file, const unsigned int line, const char *function, const char *module, const char *message)
Adds the global log_format to the outgoing buffer.
Definition: util-debug.c:656
suricata-common.h
util-path.h
SC_LOG_DEF_LOG_LEVEL
#define SC_LOG_DEF_LOG_LEVEL
Definition: util-debug.h:90
SCEnumCharMap_
Definition: util-enum.h:27
SC_LOG_ENV_LOG_OP_FILTER
#define SC_LOG_ENV_LOG_OP_FILTER
Definition: util-debug.h:41
SCLogConfig_::log_format
char * log_format
Definition: util-debug.h:173
ConfNode_::name
char * name
Definition: conf.h:33
SCLogOPIfaceCtx_::next
struct SCLogOPIfaceCtx_ * next
Definition: util-debug.h:141
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:51
SCError
SCError
Definition: util-error.h:28
SC_LOG_ENV_LOG_FORMAT
#define SC_LOG_ENV_LOG_FORMAT
Definition: util-debug.h:40
PathIsAbsolute
int PathIsAbsolute(const char *path)
Check if a path is absolute.
Definition: util-path.c:44
SC_LOG_PERF
@ SC_LOG_PERF
Definition: util-debug.h:55
SCLogConfig_
Holds the config state used by the logging api.
Definition: util-debug.h:170
SC_LOG_FMT_LOG_SLEVEL
#define SC_LOG_FMT_LOG_SLEVEL
Definition: util-debug.h:193
SCLogInitData_::op_ifaces_cnt
uint8_t op_ifaces_cnt
Definition: util-debug.h:164
SCLogOPIfaceCtx_::rotation_flag
int rotation_flag
Definition: util-debug.h:127
sc_log_fd_filters_present
int sc_log_fd_filters_present
Definition: util-debug-filters.c:39
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
FatalError
#define FatalError(...)
Definition: util-debug.h:502
LOG_WARNING
#define LOG_WARNING
Definition: win32-syslog.h:43
SC_LOG_OP_IFACE_SYSLOG
@ SC_LOG_OP_IFACE_SYSLOG
Definition: util-debug.h:67
SCLogAllocLogInitData
SCLogInitData * SCLogAllocLogInitData(void)
Returns a pointer to a new SCLogInitData. This is a public interface intended to be used after the lo...
Definition: util-debug.c:1261
SC_LOG_DEF_LOG_FORMAT_REL_CONFIG
#define SC_LOG_DEF_LOG_FORMAT_REL_CONFIG
Definition: util-debug.h:80
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
ConfigGetLogDirectory
const char * ConfigGetLogDirectory(void)
Definition: util-conf.c:37
str
#define str(s)
Definition: suricata-common.h:280
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
head
Flow * head
Definition: flow-hash.h:1
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
SC_LOG_MAX_LOG_MSG_LEN
#define SC_LOG_MAX_LOG_MSG_LEN
Definition: util-debug.h:84
SCLogOPBuffer_::temp
char * temp
Definition: util-debug.h:108
SC_LOG_FMT_FUNCTION
#define SC_LOG_FMT_FUNCTION
Definition: util-debug.h:196
SC_LOG_FMT_PID
#define SC_LOG_FMT_PID
Definition: util-debug.h:189
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:556
SCLogRemoveFDFilter
int SCLogRemoveFDFilter(const char *function)
Removes a Function-Dependent(FD) filter.
Definition: util-debug-filters.c:754
SCLogPrintFGFilters
int SCLogPrintFGFilters(void)
Prints the FG filters(both WL and BL). Used for debugging purposes.
Definition: util-debug-filters.c:411
SC_LOG_NONE
@ SC_LOG_NONE
Definition: util-debug.h:50
sc_log_global_log_level
SCLogLevel sc_log_global_log_level
Holds the global log level. Is the same as sc_log_config->log_level.
Definition: util-debug.c:101
SCLogAddFGFilterBL
int SCLogAddFGFilterBL(const char *file, const char *function, int line)
Adds a Blacklist(BL) fine-grained(FG) filter. A FG filter BL filter allows messages that don't match ...
Definition: util-debug-filters.c:354
SC_LOG_FMT_TID
#define SC_LOG_FMT_TID
Definition: util-debug.h:190
suricata.h
SCLogOPIfaceCtx_::file_d
FILE * file_d
Definition: util-debug.h:124
SCLogLoadConfig
void SCLogLoadConfig(int daemon, int verbose, uint32_t userid, uint32_t groupid)
Definition: util-debug.c:1438
SCLogAppendOPIfaceCtx
void SCLogAppendOPIfaceCtx(SCLogOPIfaceCtx *iface_ctx, SCLogInitData *sc_lid)
Appends an output_interface to the output_interface list sent in head.
Definition: util-debug.c:1321
SC_LOG_FMT_TIME
#define SC_LOG_FMT_TIME
Definition: util-debug.h:187
SCLogInitData_::startup_message
const char * startup_message
Definition: util-debug.h:150
SCLogAddFDFilter
int SCLogAddFDFilter(const char *function)
Adds a Function-Dependent(FD) filter.
Definition: util-debug-filters.c:665
msg
const char * msg
Definition: app-layer-htp.c:575
openlog
#define openlog(__ident, __option, __facility)
Definition: win32-syslog.h:76
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
util-enum.h
SCMutexDestroy
#define SCMutexDestroy
Definition: threads-debug.h:120
SC_LOG_FMT_LINE
#define SC_LOG_FMT_LINE
Definition: util-debug.h:195
SCLogInitData_::op_ifaces
SCLogOPIfaceCtx * op_ifaces
Definition: util-debug.h:162
SCLogGetLogLevel
SCLogLevel SCLogGetLogLevel(void)
Definition: util-debug.c:1076
SC_LOG_OP_IFACE_CONSOLE
@ SC_LOG_OP_IFACE_CONSOLE
Definition: util-debug.h:65
SCMutex
#define SCMutex
Definition: threads-debug.h:114
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:769
SC_LOG_DEF_FILE_FORMAT
#define SC_LOG_DEF_FILE_FORMAT
Definition: util-debug.h:77
SC_LOG_DEF_LOG_FORMAT_REL_NOTICE
#define SC_LOG_DEF_LOG_FORMAT_REL_NOTICE
Definition: util-debug.h:78
output.h
sc_log_slevel_map
SCEnumCharMap sc_log_slevel_map[]
Definition: util-debug.c:54
LOG_INFO
#define LOG_INFO
Definition: win32-syslog.h:45
LOG_ERR
#define LOG_ERR
Definition: win32-syslog.h:42
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:808
SC_LOG_FMT_TM
#define SC_LOG_FMT_TM
Definition: util-debug.h:191