suricata
util-logopenfile.c
Go to the documentation of this file.
1 /* vi: set et ts=4: */
2 /* Copyright (C) 2007-2014 Open Information Security Foundation
3  *
4  * You can copy, redistribute or modify this Program under the terms of
5  * the GNU General Public License version 2 as published by the Free
6  * Software Foundation.
7  *
8  * This program is distributed in the hope that it will be useful,
9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11  * GNU General Public License for more details.
12  *
13  * You should have received a copy of the GNU General Public License
14  * version 2 along with this program; if not, write to the Free Software
15  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
16  * 02110-1301, USA.
17  */
18 
19 /**
20  * \file
21  *
22  * \author Mike Pomraning <mpomraning@qualys.com>
23  *
24  * File-like output for logging: regular files and sockets.
25  */
26 
27 #include "suricata-common.h" /* errno.h, string.h, etc. */
28 #include "tm-modules.h" /* LogFileCtx */
29 #include "conf.h" /* ConfNode, etc. */
30 #include "output.h" /* DEFAULT_LOG_* */
31 #include "util-byte.h"
32 #include "util-path.h"
33 #include "util-logopenfile.h"
34 
35 #if defined(HAVE_SYS_UN_H) && defined(HAVE_SYS_SOCKET_H) && defined(HAVE_SYS_TYPES_H)
36 #define BUILD_WITH_UNIXSOCKET
37 #include <sys/types.h>
38 #include <sys/socket.h>
39 #include <sys/un.h>
40 #endif
41 
42 #ifdef HAVE_LIBHIREDIS
43 #include "util-log-redis.h"
44 #endif /* HAVE_LIBHIREDIS */
45 
46 #ifdef BUILD_WITH_UNIXSOCKET
47 /** \brief connect to the indicated local stream socket, logging any errors
48  * \param path filesystem path to connect to
49  * \param log_err, non-zero if connect failure should be logged.
50  * \retval FILE* on success (fdopen'd wrapper of underlying socket)
51  * \retval NULL on error
52  */
53 static FILE *
54 SCLogOpenUnixSocketFp(const char *path, int sock_type, int log_err)
55 {
56  struct sockaddr_un saun;
57  int s = -1;
58  FILE * ret = NULL;
59 
60  memset(&saun, 0x00, sizeof(saun));
61 
62  s = socket(PF_UNIX, sock_type, 0);
63  if (s < 0) goto err;
64 
65  saun.sun_family = AF_UNIX;
66  strlcpy(saun.sun_path, path, sizeof(saun.sun_path));
67 
68  if (connect(s, (const struct sockaddr *)&saun, sizeof(saun)) < 0)
69  goto err;
70 
71  ret = fdopen(s, "w");
72  if (ret == NULL)
73  goto err;
74 
75  return ret;
76 
77 err:
78  if (log_err)
80  "Error connecting to socket \"%s\": %s (will keep trying)",
81  path, strerror(errno));
82 
83  if (s >= 0)
84  close(s);
85 
86  return NULL;
87 }
88 
89 /**
90  * \brief Attempt to reconnect a disconnected (or never-connected) Unix domain socket.
91  * \retval 1 if it is now connected; otherwise 0
92  */
93 static int SCLogUnixSocketReconnect(LogFileCtx *log_ctx)
94 {
95  int disconnected = 0;
96  if (log_ctx->fp) {
98  "Write error on Unix socket \"%s\": %s; reconnecting...",
99  log_ctx->filename, strerror(errno));
100  fclose(log_ctx->fp);
101  log_ctx->fp = NULL;
102  log_ctx->reconn_timer = 0;
103  disconnected = 1;
104  }
105 
106  struct timeval tv;
107  uint64_t now;
108  gettimeofday(&tv, NULL);
109  now = (uint64_t)tv.tv_sec * 1000;
110  now += tv.tv_usec / 1000; /* msec resolution */
111  if (log_ctx->reconn_timer != 0 &&
112  (now - log_ctx->reconn_timer) < LOGFILE_RECONN_MIN_TIME) {
113  /* Don't bother to try reconnecting too often. */
114  return 0;
115  }
116  log_ctx->reconn_timer = now;
117 
118  log_ctx->fp = SCLogOpenUnixSocketFp(log_ctx->filename, log_ctx->sock_type, 0);
119  if (log_ctx->fp) {
120  /* Connected at last (or reconnected) */
121  SCLogNotice("Reconnected socket \"%s\"", log_ctx->filename);
122  } else if (disconnected) {
123  SCLogWarning(SC_ERR_SOCKET, "Reconnect failed: %s (will keep trying)",
124  strerror(errno));
125  }
126 
127  return log_ctx->fp ? 1 : 0;
128 }
129 
130 static int SCLogFileWriteSocket(const char *buffer, int buffer_len,
131  LogFileCtx *ctx)
132 {
133  int tries = 0;
134  int ret = 0;
135  bool reopen = false;
136  if (ctx->fp == NULL && ctx->is_sock) {
137  SCLogUnixSocketReconnect(ctx);
138  }
139 tryagain:
140  ret = -1;
141  reopen = 0;
142  errno = 0;
143  if (ctx->fp != NULL) {
144  int fd = fileno(ctx->fp);
145  ssize_t size = send(fd, buffer, buffer_len, ctx->send_flags);
146  if (size > -1) {
147  ret = 0;
148  } else {
149  if (errno == EAGAIN || errno == EWOULDBLOCK) {
150  SCLogDebug("Socket would block, dropping event.");
151  } else if (errno == EINTR) {
152  if (tries++ == 0) {
153  SCLogDebug("Interrupted system call, trying again.");
154  goto tryagain;
155  }
156  SCLogDebug("Too many interrupted system calls, "
157  "dropping event.");
158  } else {
159  /* Some other error. Assume badness and reopen. */
160  SCLogDebug("Send failed: %s", strerror(errno));
161  reopen = true;
162  }
163  }
164  }
165 
166  if (reopen && tries++ == 0) {
167  if (SCLogUnixSocketReconnect(ctx)) {
168  goto tryagain;
169  }
170  }
171 
172  if (ret == -1) {
173  ctx->dropped++;
174  }
175 
176  return ret;
177 }
178 #endif /* BUILD_WITH_UNIXSOCKET */
179 
180 /**
181  * \brief Write buffer to log file.
182  * \retval 0 on failure; otherwise, the return value of fwrite (number of
183  * characters successfully written).
184  */
185 static int SCLogFileWrite(const char *buffer, int buffer_len, LogFileCtx *log_ctx)
186 {
187  SCMutexLock(&log_ctx->fp_mutex);
188  int ret = 0;
189 
190 #ifdef BUILD_WITH_UNIXSOCKET
191  if (log_ctx->is_sock) {
192  ret = SCLogFileWriteSocket(buffer, buffer_len, log_ctx);
193  } else
194 #endif
195  {
196 
197  /* Check for rotation. */
198  if (log_ctx->rotation_flag) {
199  log_ctx->rotation_flag = 0;
200  SCConfLogReopen(log_ctx);
201  }
202 
203  if (log_ctx->flags & LOGFILE_ROTATE_INTERVAL) {
204  time_t now = time(NULL);
205  if (now >= log_ctx->rotate_time) {
206  SCConfLogReopen(log_ctx);
207  log_ctx->rotate_time = now + log_ctx->rotate_interval;
208  }
209  }
210 
211  if (log_ctx->fp) {
212  clearerr(log_ctx->fp);
213  ret = fwrite(buffer, buffer_len, 1, log_ctx->fp);
214  fflush(log_ctx->fp);
215  }
216  }
217 
218  SCMutexUnlock(&log_ctx->fp_mutex);
219 
220  return ret;
221 }
222 
223 /** \brief generate filename based on pattern
224  * \param pattern pattern to use
225  * \retval char* on success
226  * \retval NULL on error
227  */
228 static char *SCLogFilenameFromPattern(const char *pattern)
229 {
230  char *filename = SCMalloc(PATH_MAX);
231  if (filename == NULL) {
232  return NULL;
233  }
234 
235  int rc = SCTimeToStringPattern(time(NULL), pattern, filename, PATH_MAX);
236  if (rc != 0) {
237  SCFree(filename);
238  return NULL;
239  }
240 
241  return filename;
242 }
243 
244 static void SCLogFileClose(LogFileCtx *log_ctx)
245 {
246  if (log_ctx->fp)
247  fclose(log_ctx->fp);
248 }
249 
250 /** \brief open the indicated file, logging any errors
251  * \param path filesystem path to open
252  * \param append_setting open file with O_APPEND: "yes" or "no"
253  * \param mode permissions to set on file
254  * \retval FILE* on success
255  * \retval NULL on error
256  */
257 static FILE *
258 SCLogOpenFileFp(const char *path, const char *append_setting, uint32_t mode)
259 {
260  FILE *ret = NULL;
261 
262  char *filename = SCLogFilenameFromPattern(path);
263  if (filename == NULL) {
264  return NULL;
265  }
266 
267  int rc = SCCreateDirectoryTree(filename, false);
268  if (rc < 0) {
269  SCFree(filename);
270  return NULL;
271  }
272 
273  if (ConfValIsTrue(append_setting)) {
274  ret = fopen(filename, "a");
275  } else {
276  ret = fopen(filename, "w");
277  }
278 
279  if (ret == NULL) {
280  SCLogError(SC_ERR_FOPEN, "Error opening file: \"%s\": %s",
281  filename, strerror(errno));
282  } else {
283  if (mode != 0) {
284  int r = chmod(filename, mode);
285  if (r < 0) {
286  SCLogWarning(SC_WARN_CHMOD, "Could not chmod %s to %o: %s",
287  filename, mode, strerror(errno));
288  }
289  }
290  }
291 
292  SCFree(filename);
293  return ret;
294 }
295 
296 /** \brief open a generic output "log file", which may be a regular file or a socket
297  * \param conf ConfNode structure for the output section in question
298  * \param log_ctx Log file context allocated by caller
299  * \param default_filename Default name of file to open, if not specified in ConfNode
300  * \param rotate Register the file for rotation in HUP.
301  * \retval 0 on success
302  * \retval -1 on error
303  */
304 int
306  LogFileCtx *log_ctx,
307  const char *default_filename,
308  int rotate)
309 {
310  char log_path[PATH_MAX];
311  const char *log_dir;
312  const char *filename, *filetype;
313 
314  // Arg check
315  if (conf == NULL || log_ctx == NULL || default_filename == NULL) {
317  "SCConfLogOpenGeneric(conf %p, ctx %p, default %p) "
318  "missing an argument",
319  conf, log_ctx, default_filename);
320  return -1;
321  }
322  if (log_ctx->fp != NULL) {
324  "SCConfLogOpenGeneric: previously initialized Log CTX "
325  "encountered");
326  return -1;
327  }
328 
329  // Resolve the given config
330  filename = ConfNodeLookupChildValue(conf, "filename");
331  if (filename == NULL)
332  filename = default_filename;
333 
334  log_dir = ConfigGetLogDirectory();
335 
336  if (PathIsAbsolute(filename)) {
337  snprintf(log_path, PATH_MAX, "%s", filename);
338  } else {
339  snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename);
340  }
341 
342  /* Rotate log file based on time */
343  const char *rotate_int = ConfNodeLookupChildValue(conf, "rotate-interval");
344  if (rotate_int != NULL) {
345  time_t now = time(NULL);
346  log_ctx->flags |= LOGFILE_ROTATE_INTERVAL;
347 
348  /* Use a specific time */
349  if (strcmp(rotate_int, "minute") == 0) {
350  log_ctx->rotate_time = now + SCGetSecondsUntil(rotate_int, now);
351  log_ctx->rotate_interval = 60;
352  } else if (strcmp(rotate_int, "hour") == 0) {
353  log_ctx->rotate_time = now + SCGetSecondsUntil(rotate_int, now);
354  log_ctx->rotate_interval = 3600;
355  } else if (strcmp(rotate_int, "day") == 0) {
356  log_ctx->rotate_time = now + SCGetSecondsUntil(rotate_int, now);
357  log_ctx->rotate_interval = 86400;
358  }
359 
360  /* Use a timer */
361  else {
362  log_ctx->rotate_interval = SCParseTimeSizeString(rotate_int);
363  if (log_ctx->rotate_interval == 0) {
365  "invalid rotate-interval value");
366  exit(EXIT_FAILURE);
367  }
368  log_ctx->rotate_time = now + log_ctx->rotate_interval;
369  }
370  }
371 
372  filetype = ConfNodeLookupChildValue(conf, "filetype");
373  if (filetype == NULL)
374  filetype = DEFAULT_LOG_FILETYPE;
375 
376  const char *filemode = ConfNodeLookupChildValue(conf, "filemode");
377  uint32_t mode = 0;
378  if (filemode != NULL &&
379  ByteExtractStringUint32(&mode, 8, strlen(filemode),
380  filemode) > 0) {
381  log_ctx->filemode = mode;
382  }
383 
384  const char *append = ConfNodeLookupChildValue(conf, "append");
385  if (append == NULL)
386  append = DEFAULT_LOG_MODE_APPEND;
387 
388  /* JSON flags */
389 #ifdef HAVE_LIBJANSSON
390  log_ctx->json_flags = JSON_PRESERVE_ORDER|JSON_COMPACT|
391  JSON_ENSURE_ASCII|JSON_ESCAPE_SLASH;
392 
393  ConfNode *json_flags = ConfNodeLookupChild(conf, "json");
394 
395  if (json_flags != 0) {
396  const char *preserve_order = ConfNodeLookupChildValue(json_flags,
397  "preserve-order");
398  if (preserve_order != NULL && ConfValIsFalse(preserve_order))
399  log_ctx->json_flags &= ~(JSON_PRESERVE_ORDER);
400 
401  const char *compact = ConfNodeLookupChildValue(json_flags, "compact");
402  if (compact != NULL && ConfValIsFalse(compact))
403  log_ctx->json_flags &= ~(JSON_COMPACT);
404 
405  const char *ensure_ascii = ConfNodeLookupChildValue(json_flags,
406  "ensure-ascii");
407  if (ensure_ascii != NULL && ConfValIsFalse(ensure_ascii))
408  log_ctx->json_flags &= ~(JSON_ENSURE_ASCII);
409 
410  const char *escape_slash = ConfNodeLookupChildValue(json_flags,
411  "escape-slash");
412  if (escape_slash != NULL && ConfValIsFalse(escape_slash))
413  log_ctx->json_flags &= ~(JSON_ESCAPE_SLASH);
414  }
415 #endif /* HAVE_LIBJANSSON */
416 
417  // Now, what have we been asked to open?
418  if (strcasecmp(filetype, "unix_stream") == 0) {
419 #ifdef BUILD_WITH_UNIXSOCKET
420  /* Don't bail. May be able to connect later. */
421  log_ctx->is_sock = 1;
422  log_ctx->sock_type = SOCK_STREAM;
423  log_ctx->fp = SCLogOpenUnixSocketFp(log_path, SOCK_STREAM, 1);
424 #else
425  return -1;
426 #endif
427  } else if (strcasecmp(filetype, "unix_dgram") == 0) {
428 #ifdef BUILD_WITH_UNIXSOCKET
429  /* Don't bail. May be able to connect later. */
430  log_ctx->is_sock = 1;
431  log_ctx->sock_type = SOCK_DGRAM;
432  log_ctx->fp = SCLogOpenUnixSocketFp(log_path, SOCK_DGRAM, 1);
433 #else
434  return -1;
435 #endif
436  } else if (strcasecmp(filetype, DEFAULT_LOG_FILETYPE) == 0 ||
437  strcasecmp(filetype, "file") == 0) {
438  log_ctx->fp = SCLogOpenFileFp(log_path, append, log_ctx->filemode);
439  if (log_ctx->fp == NULL)
440  return -1; // Error already logged by Open...Fp routine
441  log_ctx->is_regular = 1;
442  if (rotate) {
444  }
445 #ifdef HAVE_LIBHIREDIS
446  } else if (strcasecmp(filetype, "redis") == 0) {
447  ConfNode *redis_node = ConfNodeLookupChild(conf, "redis");
448  if (SCConfLogOpenRedis(redis_node, log_ctx) < 0) {
449  SCLogError(SC_ERR_REDIS, "failed to open redis output");
450  return -1;
451  }
452  log_ctx->type = LOGFILE_TYPE_REDIS;
453 #endif
454  } else {
455  SCLogError(SC_ERR_INVALID_YAML_CONF_ENTRY, "Invalid entry for "
456  "%s.filetype. Expected \"regular\" (default), \"unix_stream\", "
457  "\"pcie\" "
458  "or \"unix_dgram\"",
459  conf->name);
460  }
461  log_ctx->filename = SCStrdup(log_path);
462  if (unlikely(log_ctx->filename == NULL)) {
464  "Failed to allocate memory for filename");
465  return -1;
466  }
467 
468 #ifdef BUILD_WITH_UNIXSOCKET
469  /* If a socket and running live, do non-blocking writes. */
470  if (log_ctx->is_sock && !IsRunModeOffline(RunmodeGetCurrent())) {
471  SCLogInfo("Setting logging socket of non-blocking in live mode.");
472  log_ctx->send_flags |= MSG_DONTWAIT;
473  }
474 #endif
475  SCLogInfo("%s output device (%s) initialized: %s", conf->name, filetype,
476  filename);
477 
478  return 0;
479 }
480 
481 /**
482  * \brief Reopen a regular log file with the side-affect of truncating it.
483  *
484  * This is useful to clear the log file and start a new one, or to
485  * re-open the file after its been moved by something external
486  * (eg. logrotate).
487  */
489 {
490  if (!log_ctx->is_regular) {
491  /* Not supported and not needed on non-regular files. */
492  return 0;
493  }
494 
495  if (log_ctx->filename == NULL) {
497  "Can't re-open LogFileCtx without a filename.");
498  return -1;
499  }
500 
501  if (log_ctx->fp != NULL) {
502  fclose(log_ctx->fp);
503  }
504 
505  /* Reopen the file. Append is forced in case the file was not
506  * moved as part of a rotation process. */
507  SCLogDebug("Reopening log file %s.", log_ctx->filename);
508  log_ctx->fp = SCLogOpenFileFp(log_ctx->filename, "yes", log_ctx->filemode);
509  if (log_ctx->fp == NULL) {
510  return -1; // Already logged by Open..Fp routine.
511  }
512 
513  return 0;
514 }
515 
516 /** \brief LogFileNewCtx() Get a new LogFileCtx
517  * \retval LogFileCtx * pointer if succesful, NULL if error
518  * */
520 {
521  LogFileCtx* lf_ctx;
522  lf_ctx = (LogFileCtx*)SCMalloc(sizeof(LogFileCtx));
523 
524  if (lf_ctx == NULL)
525  return NULL;
526  memset(lf_ctx, 0, sizeof(LogFileCtx));
527 
528  SCMutexInit(&lf_ctx->fp_mutex,NULL);
529 
530  // Default Write and Close functions
531  lf_ctx->Write = SCLogFileWrite;
532  lf_ctx->Close = SCLogFileClose;
533 
534  return lf_ctx;
535 }
536 
537 /** \brief LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
538  * \param motcx pointer to the OutputCtx
539  * \retval int 1 if succesful, 0 if error
540  * */
542 {
543  if (lf_ctx == NULL) {
544  SCReturnInt(0);
545  }
546 
547  if (lf_ctx->fp != NULL) {
548  SCMutexLock(&lf_ctx->fp_mutex);
549  lf_ctx->Close(lf_ctx);
550  SCMutexUnlock(&lf_ctx->fp_mutex);
551  }
552 
553  SCMutexDestroy(&lf_ctx->fp_mutex);
554 
555  if (lf_ctx->prefix != NULL) {
556  SCFree(lf_ctx->prefix);
557  lf_ctx->prefix_len = 0;
558  }
559 
560  if(lf_ctx->filename != NULL)
561  SCFree(lf_ctx->filename);
562 
563  if (lf_ctx->sensor_name)
564  SCFree(lf_ctx->sensor_name);
565 
567 
568  SCFree(lf_ctx);
569 
570  SCReturnInt(1);
571 }
572 
573 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
574 {
575  if (file_ctx->type == LOGFILE_TYPE_SYSLOG) {
576  syslog(file_ctx->syslog_setup.alert_syslog_level, "%s",
577  (const char *)MEMBUFFER_BUFFER(buffer));
578  } else if (file_ctx->type == LOGFILE_TYPE_FILE ||
579  file_ctx->type == LOGFILE_TYPE_UNIX_DGRAM ||
580  file_ctx->type == LOGFILE_TYPE_UNIX_STREAM)
581  {
582  /* append \n for files only */
583  MemBufferWriteString(buffer, "\n");
584  file_ctx->Write((const char *)MEMBUFFER_BUFFER(buffer),
585  MEMBUFFER_OFFSET(buffer), file_ctx);
586  }
587 #ifdef HAVE_LIBHIREDIS
588  else if (file_ctx->type == LOGFILE_TYPE_REDIS) {
589  SCMutexLock(&file_ctx->fp_mutex);
590  LogFileWriteRedis(file_ctx, (const char *)MEMBUFFER_BUFFER(buffer),
591  MEMBUFFER_OFFSET(buffer));
592  SCMutexUnlock(&file_ctx->fp_mutex);
593  }
594 #endif
595 
596  return 0;
597 }
#define LOGFILE_RECONN_MIN_TIME
#define SCLogDebug(...)
Definition: util-debug.h:335
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
Definition: util-buffer.h:162
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
#define unlikely(expr)
Definition: util-optimize.h:35
time_t rotate_time
SyslogSetup syslog_setup
uint64_t SCGetSecondsUntil(const char *str, time_t epoch)
Get seconds until a time unit changes.
Definition: util-time.c:589
uint8_t is_regular
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
int ByteExtractStringUint32(uint32_t *res, int base, uint16_t len, const char *str)
Definition: util-byte.c:244
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:815
#define SCMutexLock(mut)
void(* Close)(struct LogFileCtx_ *fp)
int SCTimeToStringPattern(time_t epoch, const char *pattern, char *str, size_t size)
Convert epoch time to string pattern.
Definition: util-time.c:509
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:843
#define SCMutexUnlock(mut)
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:868
enum LogFileType type
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define DEFAULT_LOG_FILETYPE
Definition: output.h:31
void OutputUnregisterFileRotationFlag(int *flag)
Unregister a file rotation flag.
Definition: output.c:890
SCMutex fp_mutex
uint32_t filemode
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:591
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
int PathIsAbsolute(const char *path)
Check if a path is absolute.
Definition: util-path.c:39
char * sensor_name
#define SCMutexInit(mut, mutattrs)
#define SCReturnInt(x)
Definition: util-debug.h:341
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:50
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:566
uint64_t rotate_interval
Definition: conf.h:32
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
const char * ConfigGetLogDirectory()
Definition: util-conf.c:36
#define SCMalloc(a)
Definition: util-mem.h:166
#define DEFAULT_LOG_MODE_APPEND
Definition: output.h:30
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
#define SCFree(a)
Definition: util-mem.h:228
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:269
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:55
bool IsRunModeOffline(int run_mode_to_check)
Definition: runmodes.c:508
char * name
Definition: conf.h:33
int RunmodeGetCurrent(void)
Definition: suricata.c:269
uint8_t send_flags
int SCConfLogReopen(LogFileCtx *log_ctx)
Reopen a regular log file with the side-affect of truncating it.
#define syslog(__pri, __fmt, __param)
Definition: win32-syslog.h:78
uint64_t reconn_timer
#define SCStrdup(a)
Definition: util-mem.h:212
uint64_t dropped
int SCCreateDirectoryTree(const char *path, const bool final)
Recursively create a directory.
Definition: util-path.c:86
#define LOGFILE_ROTATE_INTERVAL
uint64_t SCParseTimeSizeString(const char *str)
Parse string containing time size (1m, 1h, etc).
Definition: util-time.c:538
#define SCMutexDestroy