suricata
util-logopenfile.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mike Pomraning <mpomraning@qualys.com>
22  *
23  * File-like output for logging: regular files and sockets.
24  */
25 
26 #include "suricata-common.h" /* errno.h, string.h, etc. */
27 #include "util-logopenfile.h"
28 #include "suricata.h"
29 #include "conf.h" /* ConfNode, etc. */
30 #include "output.h" /* DEFAULT_LOG_* */
31 #include "util-byte.h"
32 #include "util-conf.h"
33 #include "util-path.h"
34 #include "util-misc.h"
35 #include "util-time.h"
36 
37 #if defined(HAVE_SYS_UN_H) && defined(HAVE_SYS_SOCKET_H) && defined(HAVE_SYS_TYPES_H)
38 #define BUILD_WITH_UNIXSOCKET
39 #include <sys/types.h>
40 #include <sys/socket.h>
41 #include <sys/un.h>
42 #endif
43 
44 #ifdef HAVE_LIBHIREDIS
45 #include "util-log-redis.h"
46 #endif /* HAVE_LIBHIREDIS */
47 
48 #define LOGFILE_NAME_MAX 255
49 
50 static bool LogFileNewThreadedCtx(LogFileCtx *parent_ctx, const char *log_path, const char *append,
51  ThreadLogFileHashEntry *entry);
52 
53 // Threaded eve.json identifier
54 static SC_ATOMIC_DECL_AND_INIT_WITH_VAL(uint16_t, eve_file_id, 1);
55 
56 #ifdef BUILD_WITH_UNIXSOCKET
57 /** \brief connect to the indicated local stream socket, logging any errors
58  * \param path filesystem path to connect to
59  * \param log_err, non-zero if connect failure should be logged.
60  * \retval FILE* on success (fdopen'd wrapper of underlying socket)
61  * \retval NULL on error
62  */
63 static FILE *
64 SCLogOpenUnixSocketFp(const char *path, int sock_type, int log_err)
65 {
66  struct sockaddr_un saun;
67  int s = -1;
68  FILE * ret = NULL;
69 
70  memset(&saun, 0x00, sizeof(saun));
71 
72  s = socket(PF_UNIX, sock_type, 0);
73  if (s < 0) goto err;
74 
75  saun.sun_family = AF_UNIX;
76  strlcpy(saun.sun_path, path, sizeof(saun.sun_path));
77 
78  if (connect(s, (const struct sockaddr *)&saun, sizeof(saun)) < 0)
79  goto err;
80 
81  ret = fdopen(s, "w");
82  if (ret == NULL)
83  goto err;
84 
85  return ret;
86 
87 err:
88  if (log_err)
90  "Error connecting to socket \"%s\": %s (will keep trying)", path, strerror(errno));
91 
92  if (s >= 0)
93  close(s);
94 
95  return NULL;
96 }
97 
98 /**
99  * \brief Attempt to reconnect a disconnected (or never-connected) Unix domain socket.
100  * \retval 1 if it is now connected; otherwise 0
101  */
102 static int SCLogUnixSocketReconnect(LogFileCtx *log_ctx)
103 {
104  int disconnected = 0;
105  if (log_ctx->fp) {
106  SCLogWarning("Write error on Unix socket \"%s\": %s; reconnecting...", log_ctx->filename,
107  strerror(errno));
108  fclose(log_ctx->fp);
109  log_ctx->fp = NULL;
110  log_ctx->reconn_timer = 0;
111  disconnected = 1;
112  }
113 
114  struct timeval tv;
115  uint64_t now;
116  gettimeofday(&tv, NULL);
117  now = (uint64_t)tv.tv_sec * 1000;
118  now += tv.tv_usec / 1000; /* msec resolution */
119  if (log_ctx->reconn_timer != 0 &&
120  (now - log_ctx->reconn_timer) < LOGFILE_RECONN_MIN_TIME) {
121  /* Don't bother to try reconnecting too often. */
122  return 0;
123  }
124  log_ctx->reconn_timer = now;
125 
126  log_ctx->fp = SCLogOpenUnixSocketFp(log_ctx->filename, log_ctx->sock_type, 0);
127  if (log_ctx->fp) {
128  /* Connected at last (or reconnected) */
129  SCLogDebug("Reconnected socket \"%s\"", log_ctx->filename);
130  } else if (disconnected) {
131  SCLogWarning("Reconnect failed: %s (will keep trying)", strerror(errno));
132  }
133 
134  return log_ctx->fp ? 1 : 0;
135 }
136 
137 static int SCLogFileWriteSocket(const char *buffer, int buffer_len,
138  LogFileCtx *ctx)
139 {
140  int tries = 0;
141  int ret = 0;
142  bool reopen = false;
143  if (ctx->fp == NULL && ctx->is_sock) {
144  SCLogUnixSocketReconnect(ctx);
145  }
146 tryagain:
147  ret = -1;
148  reopen = 0;
149  errno = 0;
150  if (ctx->fp != NULL) {
151  int fd = fileno(ctx->fp);
152  ssize_t size = send(fd, buffer, buffer_len, ctx->send_flags);
153  if (size > -1) {
154  ret = 0;
155  } else {
156  if (errno == EAGAIN || errno == EWOULDBLOCK) {
157  SCLogDebug("Socket would block, dropping event.");
158  } else if (errno == EINTR) {
159  if (tries++ == 0) {
160  SCLogDebug("Interrupted system call, trying again.");
161  goto tryagain;
162  }
163  SCLogDebug("Too many interrupted system calls, "
164  "dropping event.");
165  } else {
166  /* Some other error. Assume badness and reopen. */
167  SCLogDebug("Send failed: %s", strerror(errno));
168  reopen = true;
169  }
170  }
171  }
172 
173  if (reopen && tries++ == 0) {
174  if (SCLogUnixSocketReconnect(ctx)) {
175  goto tryagain;
176  }
177  }
178 
179  if (ret == -1) {
180  ctx->dropped++;
181  }
182 
183  return ret;
184 }
185 #endif /* BUILD_WITH_UNIXSOCKET */
186 static inline void OutputWriteLock(pthread_mutex_t *m)
187 {
188  SCMutexLock(m);
189 
190 }
191 
192 /**
193  * \brief Flush a log file.
194  */
195 static void SCLogFileFlushNoLock(LogFileCtx *log_ctx)
196 {
197  log_ctx->bytes_since_last_flush = 0;
198  SCFflushUnlocked(log_ctx->fp);
199 }
200 
201 static void SCLogFileFlush(LogFileCtx *log_ctx)
202 {
203  OutputWriteLock(&log_ctx->fp_mutex);
204  SCLogFileFlushNoLock(log_ctx);
205  SCMutexUnlock(&log_ctx->fp_mutex);
206 }
207 
208 /**
209  * \brief Write buffer to log file.
210  * \retval 0 on failure; otherwise, the return value of fwrite_unlocked (number of
211  * characters successfully written).
212  */
213 static int SCLogFileWriteNoLock(const char *buffer, int buffer_len, LogFileCtx *log_ctx)
214 {
215  int ret = 0;
216 
217  BUG_ON(log_ctx->is_sock);
218 
219  /* Check for rotation. */
220  if (log_ctx->rotation_flag) {
221  log_ctx->rotation_flag = 0;
222  SCConfLogReopen(log_ctx);
223  }
224 
225  if (log_ctx->flags & LOGFILE_ROTATE_INTERVAL) {
226  time_t now = time(NULL);
227  if (now >= log_ctx->rotate_time) {
228  SCConfLogReopen(log_ctx);
229  log_ctx->rotate_time = now + log_ctx->rotate_interval;
230  }
231  }
232 
233  if (log_ctx->fp) {
234  SCClearErrUnlocked(log_ctx->fp);
235  if (1 != SCFwriteUnlocked(buffer, buffer_len, 1, log_ctx->fp)) {
236  /* Only the first error is logged */
237  if (!log_ctx->output_errors) {
238  SCLogError("%s error while writing to %s",
239  SCFerrorUnlocked(log_ctx->fp) ? strerror(errno) : "unknown error",
240  log_ctx->filename);
241  }
242  log_ctx->output_errors++;
243  return ret;
244  }
245 
246  log_ctx->bytes_since_last_flush += buffer_len;
247 
248  if (log_ctx->buffer_size && log_ctx->bytes_since_last_flush >= log_ctx->buffer_size) {
249  SCLogDebug("%s: flushing %" PRIu64 " during write", log_ctx->filename,
250  log_ctx->bytes_since_last_flush);
251  SCLogFileFlushNoLock(log_ctx);
252  }
253  }
254 
255  return ret;
256 }
257 
258 /**
259  * \brief Write buffer to log file.
260  * \retval 0 on failure; otherwise, the return value of fwrite (number of
261  * characters successfully written).
262  */
263 static int SCLogFileWrite(const char *buffer, int buffer_len, LogFileCtx *log_ctx)
264 {
265  OutputWriteLock(&log_ctx->fp_mutex);
266  int ret = 0;
267 
268 #ifdef BUILD_WITH_UNIXSOCKET
269  if (log_ctx->is_sock) {
270  ret = SCLogFileWriteSocket(buffer, buffer_len, log_ctx);
271  } else
272 #endif
273  {
274  ret = SCLogFileWriteNoLock(buffer, buffer_len, log_ctx);
275  }
276 
277  SCMutexUnlock(&log_ctx->fp_mutex);
278 
279  return ret;
280 }
281 
282 /** \brief generate filename based on pattern
283  * \param pattern pattern to use
284  * \retval char* on success
285  * \retval NULL on error
286  */
287 static char *SCLogFilenameFromPattern(const char *pattern)
288 {
289  char *filename = SCMalloc(PATH_MAX);
290  if (filename == NULL) {
291  return NULL;
292  }
293 
294  int rc = SCTimeToStringPattern(time(NULL), pattern, filename, PATH_MAX);
295  if (rc != 0) {
296  SCFree(filename);
297  return NULL;
298  }
299 
300  return filename;
301 }
302 
303 static void SCLogFileCloseNoLock(LogFileCtx *log_ctx)
304 {
305  SCLogDebug("Closing %s", log_ctx->filename);
306  if (log_ctx->fp) {
307  if (log_ctx->buffer_size)
308  SCFflushUnlocked(log_ctx->fp);
309  fclose(log_ctx->fp);
310  }
311 
312  if (log_ctx->output_errors) {
313  SCLogError("There were %" PRIu64 " output errors to %s", log_ctx->output_errors,
314  log_ctx->filename);
315  }
316 }
317 
318 static void SCLogFileClose(LogFileCtx *log_ctx)
319 {
320  SCMutexLock(&log_ctx->fp_mutex);
321  SCLogFileCloseNoLock(log_ctx);
322  SCMutexUnlock(&log_ctx->fp_mutex);
323 }
324 
325 static char ThreadLogFileHashCompareFunc(
326  void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
327 {
330 
331  if (p1 == NULL || p2 == NULL)
332  return 0;
333 
334  return p1->thread_id == p2->thread_id;
335 }
336 static uint32_t ThreadLogFileHashFunc(HashTable *ht, void *data, uint16_t datalen)
337 {
338  const ThreadLogFileHashEntry *ent = (ThreadLogFileHashEntry *)data;
339 
340  return ent->thread_id % ht->array_size;
341 }
342 
343 static void ThreadLogFileHashFreeFunc(void *data)
344 {
345  BUG_ON(data == NULL);
346  ThreadLogFileHashEntry *thread_ent = (ThreadLogFileHashEntry *)data;
347 
348  if (!thread_ent)
349  return;
350 
351  if (thread_ent->isopen) {
352  LogFileCtx *lf_ctx = thread_ent->ctx;
353  /* Free the leaf log file entries */
354  if (!lf_ctx->threaded) {
355  LogFileFreeCtx(lf_ctx);
356  }
357  }
358  SCFree(thread_ent);
359 }
360 
361 bool SCLogOpenThreadedFile(const char *log_path, const char *append, LogFileCtx *parent_ctx)
362 {
363  parent_ctx->threads = SCCalloc(1, sizeof(LogThreadedFileCtx));
364  if (!parent_ctx->threads) {
365  SCLogError("Unable to allocate threads container");
366  return false;
367  }
368 
369  parent_ctx->threads->ht = HashTableInit(255, ThreadLogFileHashFunc,
370  ThreadLogFileHashCompareFunc, ThreadLogFileHashFreeFunc);
371  if (!parent_ctx->threads->ht) {
372  FatalError("Unable to initialize thread/entry hash table");
373  }
374 
375  parent_ctx->threads->append = SCStrdup(append == NULL ? DEFAULT_LOG_MODE_APPEND : append);
376  if (!parent_ctx->threads->append) {
377  SCLogError("Unable to allocate threads append setting");
378  goto error_exit;
379  }
380 
381  SCMutexInit(&parent_ctx->threads->mutex, NULL);
382  return true;
383 
384 error_exit:
385 
386  if (parent_ctx->threads->append) {
387  SCFree(parent_ctx->threads->append);
388  }
389  if (parent_ctx->threads->ht) {
390  HashTableFree(parent_ctx->threads->ht);
391  }
392  SCFree(parent_ctx->threads);
393  parent_ctx->threads = NULL;
394  return false;
395 }
396 
397 /** \brief open the indicated file, logging any errors
398  * \param path filesystem path to open
399  * \param append_setting open file with O_APPEND: "yes" or "no"
400  * \param mode permissions to set on file
401  * \retval FILE* on success
402  * \retval NULL on error
403  */
404 static FILE *SCLogOpenFileFp(
405  const char *path, const char *append_setting, uint32_t mode, const uint32_t buffer_size)
406 {
407  FILE *ret = NULL;
408 
409  char *filename = SCLogFilenameFromPattern(path);
410  if (filename == NULL) {
411  return NULL;
412  }
413 
414  int rc = SCCreateDirectoryTree(filename, false);
415  if (rc < 0) {
416  SCFree(filename);
417  return NULL;
418  }
419 
420  if (ConfValIsTrue(append_setting)) {
421  ret = fopen(filename, "a");
422  } else {
423  ret = fopen(filename, "w");
424  }
425 
426  if (ret == NULL) {
427  SCLogError("Error opening file: \"%s\": %s", filename, strerror(errno));
428  goto error_exit;
429  } else {
430  if (mode != 0) {
431 #ifdef OS_WIN32
432  int r = _chmod(filename, (mode_t)mode);
433 #else
434  int r = fchmod(fileno(ret), (mode_t)mode);
435 #endif
436  if (r < 0) {
437  SCLogWarning("Could not chmod %s to %o: %s", filename, mode, strerror(errno));
438  }
439  }
440  }
441 
442  /* Set buffering behavior */
443  if (buffer_size == 0) {
444  setbuf(ret, NULL);
445  SCLogConfig("Setting output to %s non-buffered", filename);
446  } else {
447  if (setvbuf(ret, NULL, _IOFBF, buffer_size) < 0)
448  FatalError("unable to set %s to buffered: %d", filename, buffer_size);
449  SCLogConfig("Setting output to %s buffered [limit %d bytes]", filename, buffer_size);
450  }
451 
452 error_exit:
453  SCFree(filename);
454 
455  return ret;
456 }
457 
458 /** \brief open a generic output "log file", which may be a regular file or a socket
459  * \param conf ConfNode structure for the output section in question
460  * \param log_ctx Log file context allocated by caller
461  * \param default_filename Default name of file to open, if not specified in ConfNode
462  * \param rotate Register the file for rotation in HUP.
463  * \retval 0 on success
464  * \retval -1 on error
465  */
466 int
468  LogFileCtx *log_ctx,
469  const char *default_filename,
470  int rotate)
471 {
472  char log_path[PATH_MAX];
473  const char *log_dir;
474  const char *filename, *filetype;
475 
476  // Arg check
477  if (conf == NULL || log_ctx == NULL || default_filename == NULL) {
478  SCLogError("SCConfLogOpenGeneric(conf %p, ctx %p, default %p) "
479  "missing an argument",
480  conf, log_ctx, default_filename);
481  return -1;
482  }
483  if (log_ctx->fp != NULL) {
484  SCLogError("SCConfLogOpenGeneric: previously initialized Log CTX "
485  "encountered");
486  return -1;
487  }
488 
489  // Resolve the given config
490  filename = ConfNodeLookupChildValue(conf, "filename");
491  if (filename == NULL)
492  filename = default_filename;
493 
494  log_dir = ConfigGetLogDirectory();
495 
496  if (PathIsAbsolute(filename)) {
497  snprintf(log_path, PATH_MAX, "%s", filename);
498  } else {
499  snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename);
500  }
501 
502  /* Rotate log file based on time */
503  const char *rotate_int = ConfNodeLookupChildValue(conf, "rotate-interval");
504  if (rotate_int != NULL) {
505  time_t now = time(NULL);
506  log_ctx->flags |= LOGFILE_ROTATE_INTERVAL;
507 
508  /* Use a specific time */
509  if (strcmp(rotate_int, "minute") == 0) {
510  log_ctx->rotate_time = now + SCGetSecondsUntil(rotate_int, now);
511  log_ctx->rotate_interval = 60;
512  } else if (strcmp(rotate_int, "hour") == 0) {
513  log_ctx->rotate_time = now + SCGetSecondsUntil(rotate_int, now);
514  log_ctx->rotate_interval = 3600;
515  } else if (strcmp(rotate_int, "day") == 0) {
516  log_ctx->rotate_time = now + SCGetSecondsUntil(rotate_int, now);
517  log_ctx->rotate_interval = 86400;
518  }
519 
520  /* Use a timer */
521  else {
522  log_ctx->rotate_interval = SCParseTimeSizeString(rotate_int);
523  if (log_ctx->rotate_interval == 0) {
524  FatalError("invalid rotate-interval value");
525  }
526  log_ctx->rotate_time = now + log_ctx->rotate_interval;
527  }
528  }
529 
530  filetype = ConfNodeLookupChildValue(conf, "filetype");
531  if (filetype == NULL)
532  filetype = DEFAULT_LOG_FILETYPE;
533 
534  /* Determine the buffering for this output device; a value of 0 means to not buffer;
535  * any other value must be a multiple of 4096
536  * The default value is 0 (no buffering)
537  */
538  uint32_t buffer_size = LOGFILE_EVE_BUFFER_SIZE;
539  const char *buffer_size_value = ConfNodeLookupChildValue(conf, "buffer-size");
540  if (buffer_size_value != NULL) {
541  uint32_t value;
542  if (ParseSizeStringU32(buffer_size_value, &value) < 0) {
543  FatalError("Error parsing "
544  "buffer-size - %s. Killing engine",
545  buffer_size_value);
546  }
547  buffer_size = value;
548  }
549 
550  SCLogDebug("buffering: %s -> %d", buffer_size_value, buffer_size);
551  const char *filemode = ConfNodeLookupChildValue(conf, "filemode");
552  uint32_t mode = 0;
553  if (filemode != NULL && StringParseUint32(&mode, 8, (uint16_t)strlen(filemode), filemode) > 0) {
554  log_ctx->filemode = mode;
555  }
556 
557  const char *append = ConfNodeLookupChildValue(conf, "append");
558  if (append == NULL)
559  append = DEFAULT_LOG_MODE_APPEND;
560 
561  /* JSON flags */
562  log_ctx->json_flags = JSON_PRESERVE_ORDER|JSON_COMPACT|
563  JSON_ENSURE_ASCII|JSON_ESCAPE_SLASH;
564 
565  ConfNode *json_flags = ConfNodeLookupChild(conf, "json");
566 
567  if (json_flags != 0) {
568  const char *preserve_order = ConfNodeLookupChildValue(json_flags,
569  "preserve-order");
570  if (preserve_order != NULL && ConfValIsFalse(preserve_order))
571  log_ctx->json_flags &= ~(JSON_PRESERVE_ORDER);
572 
573  const char *compact = ConfNodeLookupChildValue(json_flags, "compact");
574  if (compact != NULL && ConfValIsFalse(compact))
575  log_ctx->json_flags &= ~(JSON_COMPACT);
576 
577  const char *ensure_ascii = ConfNodeLookupChildValue(json_flags,
578  "ensure-ascii");
579  if (ensure_ascii != NULL && ConfValIsFalse(ensure_ascii))
580  log_ctx->json_flags &= ~(JSON_ENSURE_ASCII);
581 
582  const char *escape_slash = ConfNodeLookupChildValue(json_flags,
583  "escape-slash");
584  if (escape_slash != NULL && ConfValIsFalse(escape_slash))
585  log_ctx->json_flags &= ~(JSON_ESCAPE_SLASH);
586  }
587 
588 #ifdef BUILD_WITH_UNIXSOCKET
589  if (log_ctx->threaded) {
590  if (strcasecmp(filetype, "unix_stream") == 0 || strcasecmp(filetype, "unix_dgram") == 0) {
591  FatalError("Socket file types do not support threaded output");
592  }
593  }
594 #endif
595  if (!(strcasecmp(filetype, DEFAULT_LOG_FILETYPE) == 0 || strcasecmp(filetype, "file") == 0)) {
596  SCLogConfig("buffering setting ignored for %s output types", filetype);
597  }
598 
599  // Now, what have we been asked to open?
600  if (strcasecmp(filetype, "unix_stream") == 0) {
601 #ifdef BUILD_WITH_UNIXSOCKET
602  /* Don't bail. May be able to connect later. */
603  log_ctx->is_sock = 1;
604  log_ctx->sock_type = SOCK_STREAM;
605  log_ctx->fp = SCLogOpenUnixSocketFp(log_path, SOCK_STREAM, 1);
606 #else
607  return -1;
608 #endif
609  } else if (strcasecmp(filetype, "unix_dgram") == 0) {
610 #ifdef BUILD_WITH_UNIXSOCKET
611  /* Don't bail. May be able to connect later. */
612  log_ctx->is_sock = 1;
613  log_ctx->sock_type = SOCK_DGRAM;
614  log_ctx->fp = SCLogOpenUnixSocketFp(log_path, SOCK_DGRAM, 1);
615 #else
616  return -1;
617 #endif
618  } else if (strcasecmp(filetype, DEFAULT_LOG_FILETYPE) == 0 ||
619  strcasecmp(filetype, "file") == 0) {
620  log_ctx->is_regular = 1;
621  log_ctx->buffer_size = buffer_size;
622  if (!log_ctx->threaded) {
623  log_ctx->fp =
624  SCLogOpenFileFp(log_path, append, log_ctx->filemode, log_ctx->buffer_size);
625  if (log_ctx->fp == NULL)
626  return -1; // Error already logged by Open...Fp routine
627  } else {
628  if (!SCLogOpenThreadedFile(log_path, append, log_ctx)) {
629  return -1;
630  }
631  }
632  if (rotate) {
634  }
635  } else {
636  SCLogError("Invalid entry for "
637  "%s.filetype. Expected \"regular\" (default), \"unix_stream\", "
638  "or \"unix_dgram\"",
639  conf->name);
640  }
641  log_ctx->filename = SCStrdup(log_path);
642  if (unlikely(log_ctx->filename == NULL)) {
643  SCLogError("Failed to allocate memory for filename");
644  return -1;
645  }
646 
647 #ifdef BUILD_WITH_UNIXSOCKET
648  /* If a socket and running live, do non-blocking writes. */
649  if (log_ctx->is_sock && !IsRunModeOffline(SCRunmodeGet())) {
650  SCLogInfo("Setting logging socket of non-blocking in live mode.");
651  log_ctx->send_flags |= MSG_DONTWAIT;
652  }
653 #endif
654  SCLogInfo("%s output device (%s) initialized: %s", conf->name, filetype,
655  filename);
656 
657  return 0;
658 }
659 
660 /**
661  * \brief Reopen a regular log file with the side-affect of truncating it.
662  *
663  * This is useful to clear the log file and start a new one, or to
664  * re-open the file after its been moved by something external
665  * (eg. logrotate).
666  */
668 {
669  if (!log_ctx->is_regular) {
670  /* Not supported and not needed on non-regular files. */
671  return 0;
672  }
673 
674  if (log_ctx->filename == NULL) {
675  SCLogWarning("Can't re-open LogFileCtx without a filename.");
676  return -1;
677  }
678 
679  if (log_ctx->fp != NULL) {
680  fclose(log_ctx->fp);
681  }
682 
683  /* Reopen the file. Append is forced in case the file was not
684  * moved as part of a rotation process. */
685  SCLogDebug("Reopening log file %s.", log_ctx->filename);
686  log_ctx->fp =
687  SCLogOpenFileFp(log_ctx->filename, "yes", log_ctx->filemode, log_ctx->buffer_size);
688  if (log_ctx->fp == NULL) {
689  return -1; // Already logged by Open..Fp routine.
690  }
691 
692  return 0;
693 }
694 
695 /** \brief LogFileNewCtx() Get a new LogFileCtx
696  * \retval LogFileCtx * pointer if successful, NULL if error
697  * */
699 {
700  LogFileCtx* lf_ctx;
701  lf_ctx = (LogFileCtx*)SCCalloc(1, sizeof(LogFileCtx));
702 
703  if (lf_ctx == NULL)
704  return NULL;
705 
706  lf_ctx->Write = SCLogFileWrite;
707  lf_ctx->Close = SCLogFileClose;
708  lf_ctx->Flush = SCLogFileFlush;
709 
710  return lf_ctx;
711 }
712 
713 /** \brief LogFileThread2Slot() Return a file entry
714  * \retval ThreadLogFileHashEntry * file entry for caller
715  *
716  * This function returns the file entry for the calling thread.
717  * Each thread -- identified by its operating system thread-id -- has its
718  * own file entry that includes a file pointer.
719  */
720 static ThreadLogFileHashEntry *LogFileThread2Slot(LogThreadedFileCtx *parent, ThreadId thread_id)
721 {
722  ThreadLogFileHashEntry thread_hash_entry;
723 
724  /* Check hash table for thread id*/
725  thread_hash_entry.thread_id = SCGetThreadIdLong();
727  HashTableLookup(parent->ht, &thread_hash_entry, sizeof(thread_hash_entry));
728 
729  if (!ent) {
730  ent = SCCalloc(1, sizeof(*ent));
731  if (!ent) {
732  FatalError("Unable to allocate thread/hash-entry entry");
733  }
734  ent->thread_id = thread_hash_entry.thread_id;
735  ent->internal_thread_id = thread_id;
736  SCLogDebug(
737  "Trying to add thread %" PRIi64 " to entry %d", ent->thread_id, ent->slot_number);
738  if (0 != HashTableAdd(parent->ht, ent, 0)) {
739  FatalError("Unable to add thread/hash-entry mapping");
740  }
741  }
742  return ent;
743 }
744 
745 /** \brief LogFileEnsureExists() Ensure a log file context for the thread exists
746  * \param parent_ctx
747  * \retval LogFileCtx * pointer if successful; NULL otherwise
748  */
750 {
751  /* threaded output disabled */
752  if (!parent_ctx->threaded)
753  return parent_ctx;
754 
755  LogFileCtx *ret_ctx = NULL;
756  SCMutexLock(&parent_ctx->threads->mutex);
757  /* Find this thread's entry */
758  ThreadLogFileHashEntry *entry = LogFileThread2Slot(parent_ctx->threads, thread_id);
759  SCLogDebug("%s: Adding reference for thread %" PRIi64
760  " (local thread id %d) to file %s [ctx %p]",
761  t_thread_name, SCGetThreadIdLong(), thread_id, parent_ctx->filename, parent_ctx);
762 
763  bool new = entry->isopen;
764  /* has it been opened yet? */
765  if (!new) {
766  SCLogDebug("%s: Opening new file for thread/id %d to file %s [ctx %p]", t_thread_name,
767  thread_id, parent_ctx->filename, parent_ctx);
768  if (LogFileNewThreadedCtx(
769  parent_ctx, parent_ctx->filename, parent_ctx->threads->append, entry)) {
770  entry->isopen = true;
771  ret_ctx = entry->ctx;
772  } else {
773  SCLogDebug(
774  "Unable to open slot %d for file %s", entry->slot_number, parent_ctx->filename);
775  (void)HashTableRemove(parent_ctx->threads->ht, entry, 0);
776  }
777  } else {
778  ret_ctx = entry->ctx;
779  }
780  SCMutexUnlock(&parent_ctx->threads->mutex);
781 
783  if (new) {
784  SCLogDebug("Existing file for thread/entry %p reference to file %s [ctx %p]", entry,
785  parent_ctx->filename, parent_ctx);
786  }
787  }
788 
789  return ret_ctx;
790 }
791 
792 /** \brief LogFileThreadedName() Create file name for threaded EVE storage
793  *
794  */
795 static bool LogFileThreadedName(
796  const char *original_name, char *threaded_name, size_t len, uint32_t unique_id)
797 {
798  sc_errno = SC_OK;
799 
800  if (strcmp("/dev/null", original_name) == 0) {
801  strlcpy(threaded_name, original_name, len);
802  return true;
803  }
804 
805  const char *base = SCBasename(original_name);
806  if (!base) {
807  FatalError("Invalid filename for threaded mode \"%s\"; "
808  "no basename found.",
809  original_name);
810  }
811 
812  /* Check if basename has an extension */
813  char *dot = strrchr(base, '.');
814  if (dot) {
815  char *tname = SCStrdup(original_name);
816  if (!tname) {
818  return false;
819  }
820 
821  /* Fetch extension location from original, not base
822  * for update
823  */
824  dot = strrchr(original_name, '.');
825  ptrdiff_t dotpos = dot - original_name;
826  tname[dotpos] = '\0';
827  char *ext = tname + dotpos + 1;
828  if (strlen(tname) && strlen(ext)) {
829  snprintf(threaded_name, len, "%s.%u.%s", tname, unique_id, ext);
830  } else {
831  FatalError("Invalid filename for threaded mode \"%s\"; "
832  "filenames must include an extension, e.g: \"name.ext\"",
833  original_name);
834  }
835  SCFree(tname);
836  } else {
837  snprintf(threaded_name, len, "%s.%u", original_name, unique_id);
838  }
839  return true;
840 }
841 
842 /** \brief LogFileNewThreadedCtx() Create file context for threaded output
843  * \param parent_ctx
844  * \param log_path
845  * \param append
846  * \param entry
847  */
848 static bool LogFileNewThreadedCtx(LogFileCtx *parent_ctx, const char *log_path, const char *append,
849  ThreadLogFileHashEntry *entry)
850 {
851  LogFileCtx *thread = SCCalloc(1, sizeof(LogFileCtx));
852  if (!thread) {
853  SCLogError("Unable to allocate thread file context entry %p", entry);
854  return false;
855  }
856 
857  *thread = *parent_ctx;
858  if (parent_ctx->type == LOGFILE_TYPE_FILE) {
859  char fname[LOGFILE_NAME_MAX];
860  entry->slot_number = SC_ATOMIC_ADD(eve_file_id, 1);
861  if (!LogFileThreadedName(log_path, fname, sizeof(fname), entry->slot_number)) {
862  SCLogError("Unable to create threaded filename for log");
863  goto error;
864  }
865  SCLogDebug("%s: thread open -- using name %s [replaces %s] - thread %d [slot %d]",
866  t_thread_name, fname, log_path, entry->internal_thread_id, entry->slot_number);
867  thread->fp = SCLogOpenFileFp(fname, append, thread->filemode, parent_ctx->buffer_size);
868  if (thread->fp == NULL) {
869  goto error;
870  }
871  thread->filename = SCStrdup(fname);
872  if (!thread->filename) {
873  SCLogError("Unable to duplicate filename for context entry %p", entry);
874  goto error;
875  }
876  thread->is_regular = true;
877  thread->Write = SCLogFileWriteNoLock;
878  thread->Close = SCLogFileCloseNoLock;
880  } else if (parent_ctx->type == LOGFILE_TYPE_FILETYPE) {
881  entry->slot_number = SC_ATOMIC_ADD(eve_file_id, 1);
882  SCLogDebug("%s - thread %d [slot %d]", log_path, entry->internal_thread_id,
883  entry->slot_number);
885  &thread->filetype.thread_data);
886  }
887  thread->threaded = false;
888  thread->parent = parent_ctx;
889  thread->entry = entry;
890  entry->ctx = thread;
891 
892  return true;
893 
894 error:
895  if (parent_ctx->type == LOGFILE_TYPE_FILE) {
896  SC_ATOMIC_SUB(eve_file_id, 1);
897  if (thread->fp) {
898  thread->Close(thread);
899  }
900  }
901 
902  if (thread) {
903  SCFree(thread);
904  }
905  return false;
906 }
907 
908 /** \brief LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
909  * \param lf_ctx pointer to the OutputCtx
910  * \retval int 1 if successful, 0 if error
911  * */
913 {
914  if (lf_ctx == NULL) {
915  SCReturnInt(0);
916  }
917 
918  if (lf_ctx->type == LOGFILE_TYPE_FILETYPE && lf_ctx->filetype.filetype->ThreadDeinit) {
919  lf_ctx->filetype.filetype->ThreadDeinit(
920  lf_ctx->filetype.init_data, lf_ctx->filetype.thread_data);
921  }
922 
923  if (lf_ctx->threaded) {
924  BUG_ON(lf_ctx->threads == NULL);
925  SCMutexDestroy(&lf_ctx->threads->mutex);
926  if (lf_ctx->threads->append)
927  SCFree(lf_ctx->threads->append);
928  if (lf_ctx->threads->ht) {
929  HashTableFree(lf_ctx->threads->ht);
930  }
931  SCFree(lf_ctx->threads);
932  } else {
933  if (lf_ctx->type != LOGFILE_TYPE_FILETYPE) {
934  if (lf_ctx->fp != NULL) {
935  lf_ctx->Close(lf_ctx);
936  }
937  }
938  SCMutexDestroy(&lf_ctx->fp_mutex);
939  }
940 
941  if (lf_ctx->prefix != NULL) {
942  SCFree(lf_ctx->prefix);
943  lf_ctx->prefix_len = 0;
944  }
945 
946  if(lf_ctx->filename != NULL)
947  SCFree(lf_ctx->filename);
948 
949  if (lf_ctx->sensor_name)
950  SCFree(lf_ctx->sensor_name);
951 
952  if (!lf_ctx->threaded) {
954  }
955 
956  /* Deinitialize output filetypes. We only want to call this for
957  * the parent of threaded output, or always for non-threaded
958  * output. */
959  if (lf_ctx->type == LOGFILE_TYPE_FILETYPE && lf_ctx->parent == NULL) {
960  lf_ctx->filetype.filetype->Deinit(lf_ctx->filetype.init_data);
961  }
962 
963 #ifdef HAVE_LIBHIREDIS
964  if (lf_ctx->type == LOGFILE_TYPE_REDIS) {
965  if (lf_ctx->redis_setup.stream_format != NULL) {
966  SCFree(lf_ctx->redis_setup.stream_format);
967  }
968  }
969 #endif
970 
971  memset(lf_ctx, 0, sizeof(*lf_ctx));
972  SCFree(lf_ctx);
973 
974  SCReturnInt(1);
975 }
976 
977 void LogFileFlush(LogFileCtx *file_ctx)
978 {
979  SCLogDebug("%s: bytes-to-flush %ld", file_ctx->filename, file_ctx->bytes_since_last_flush);
980  file_ctx->Flush(file_ctx);
981 }
982 
983 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
984 {
985  if (file_ctx->type == LOGFILE_TYPE_FILE || file_ctx->type == LOGFILE_TYPE_UNIX_DGRAM ||
986  file_ctx->type == LOGFILE_TYPE_UNIX_STREAM) {
987  /* append \n for files only */
988  MemBufferWriteString(buffer, "\n");
989  file_ctx->Write((const char *)MEMBUFFER_BUFFER(buffer),
990  MEMBUFFER_OFFSET(buffer), file_ctx);
991  } else if (file_ctx->type == LOGFILE_TYPE_FILETYPE) {
992  file_ctx->filetype.filetype->Write((const char *)MEMBUFFER_BUFFER(buffer),
993  MEMBUFFER_OFFSET(buffer), file_ctx->filetype.init_data,
994  file_ctx->filetype.thread_data);
995  }
996 #ifdef HAVE_LIBHIREDIS
997  else if (file_ctx->type == LOGFILE_TYPE_REDIS) {
998  SCMutexLock(&file_ctx->fp_mutex);
999  LogFileWriteRedis(file_ctx, (const char *)MEMBUFFER_BUFFER(buffer),
1000  MEMBUFFER_OFFSET(buffer));
1001  SCMutexUnlock(&file_ctx->fp_mutex);
1002  }
1003 #endif
1004 
1005  return 0;
1006 }
SCParseTimeSizeString
uint64_t SCParseTimeSizeString(const char *str)
Parse string containing time size (1m, 1h, etc).
Definition: util-time.c:570
LogFileCtx_::rotation_flag
int rotation_flag
Definition: util-logopenfile.h:153
util-byte.h
LogThreadedFileCtx_::append
char * append
Definition: util-logopenfile.h:62
SCFerrorUnlocked
#define SCFerrorUnlocked
Definition: suricata-common.h:543
len
uint8_t len
Definition: app-layer-dnp3.h:2
LOGFILE_TYPE_REDIS
@ LOGFILE_TYPE_REDIS
Definition: util-logopenfile.h:42
SCRunmodeGet
int SCRunmodeGet(void)
Get the current run mode.
Definition: suricata.c:264
LogFileCtx_::sensor_name
char * sensor_name
Definition: util-logopenfile.h:115
LogFileCtx_::reconn_timer
uint64_t reconn_timer
Definition: util-logopenfile.h:120
SC_LOG_DEBUG
@ SC_LOG_DEBUG
Definition: util-debug.h:57
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:95
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SC_ATOMIC_DECL_AND_INIT_WITH_VAL
#define SC_ATOMIC_DECL_AND_INIT_WITH_VAL(type, name, val)
wrapper for declaring an atomic variable and initializing it to a specific value
Definition: util-atomic.h:303
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:698
SCGetSecondsUntil
uint64_t SCGetSecondsUntil(const char *str, time_t epoch)
Get seconds until a time unit changes.
Definition: util-time.c:621
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
LogFileFlush
void LogFileFlush(LogFileCtx *file_ctx)
Definition: util-logopenfile.c:977
LogFileCtx_::json_flags
size_t json_flags
Definition: util-logopenfile.h:150
ctx
struct Thresholds ctx
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
LogFileCtx_
Definition: util-logopenfile.h:72
SCEveFileType_::Write
int(* Write)(const char *buffer, const int buffer_len, const void *init_data, void *thread_data)
Called for each EVE log record.
Definition: output-eve.h:144
LOGFILE_RECONN_MIN_TIME
#define LOGFILE_RECONN_MIN_TIME
Definition: util-logopenfile.h:169
DEFAULT_LOG_MODE_APPEND
#define DEFAULT_LOG_MODE_APPEND
Definition: output.h:30
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
HashTable_
Definition: util-hash.h:35
util-log-redis.h
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:87
LogFileCtx_::filename
char * filename
Definition: util-logopenfile.h:106
LOGFILE_NAME_MAX
#define LOGFILE_NAME_MAX
Definition: util-logopenfile.c:48
JSON_ESCAPE_SLASH
#define JSON_ESCAPE_SLASH
Definition: suricata-common.h:282
m
SCMutex m
Definition: flow-hash.h:6
ThreadLogFileHashEntry::ctx
struct LogFileCtx_ * ctx
Definition: util-logopenfile.h:49
LogFileCtx_::send_flags
uint8_t send_flags
Definition: util-logopenfile.h:143
SCConfLogReopen
int SCConfLogReopen(LogFileCtx *log_ctx)
Reopen a regular log file with the side-affect of truncating it.
Definition: util-logopenfile.c:667
IsRunModeOffline
bool IsRunModeOffline(enum RunModes run_mode_to_check)
Definition: runmodes.c:544
ThreadLogFileHashEntry::slot_number
uint16_t slot_number
Definition: util-logopenfile.h:54
ThreadLogFileHashEntry::isopen
bool isopen
Definition: util-logopenfile.h:55
SCClearErrUnlocked
#define SCClearErrUnlocked
Definition: suricata-common.h:542
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:536
SC_ENOMEM
@ SC_ENOMEM
Definition: util-error.h:29
ThreadId
uint32_t ThreadId
Definition: output-eve.h:37
HashTableFree
void HashTableFree(HashTable *ht)
Definition: util-hash.c:78
t_thread_name
thread_local char t_thread_name[THREAD_NAME_LEN+1]
Definition: threads.c:33
HashTable_::array_size
uint32_t array_size
Definition: util-hash.h:37
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:467
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
LogFileCtx_::sock_type
int sock_type
Definition: util-logopenfile.h:119
SCEveFileType_::ThreadDeinit
void(* ThreadDeinit)(const void *init_data, void *thread_data)
Called to deinitialize each thread.
Definition: output-eve.h:157
OutputRegisterFileRotationFlag
void OutputRegisterFileRotationFlag(int *flag)
Register a flag for file rotation notification.
Definition: output.c:666
LogFileCtx_::filetype
LogFileTypeCtx filetype
Definition: util-logopenfile.h:91
SCTimeToStringPattern
int SCTimeToStringPattern(time_t epoch, const char *pattern, char *str, size_t size)
Convert epoch time to string pattern.
Definition: util-time.c:541
LogFileWrite
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
Definition: util-logopenfile.c:983
LogFileCtx_::rotate_interval
uint64_t rotate_interval
Definition: util-logopenfile.h:127
DEFAULT_LOG_FILETYPE
#define DEFAULT_LOG_FILETYPE
Definition: output.h:31
LogFileCtx_::is_sock
int is_sock
Definition: util-logopenfile.h:118
SCFwriteUnlocked
#define SCFwriteUnlocked
Definition: suricata-common.h:540
LogFileCtx_::prefix_len
uint32_t prefix_len
Definition: util-logopenfile.h:132
SCFflushUnlocked
#define SCFflushUnlocked
Definition: suricata-common.h:541
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:183
HashTableRemove
int HashTableRemove(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:142
ThreadLogFileHashEntry::internal_thread_id
ThreadId internal_thread_id
Definition: util-logopenfile.h:52
StringParseUint32
int StringParseUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:313
util-time.h
LOGFILE_EVE_BUFFER_SIZE
#define LOGFILE_EVE_BUFFER_SIZE
Definition: util-logopenfile.h:175
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
HashTableAdd
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:104
LogFileCtx_::type
enum LogFileType type
Definition: util-logopenfile.h:103
LOGFILE_TYPE_FILE
@ LOGFILE_TYPE_FILE
Definition: util-logopenfile.h:39
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:309
LogFileCtx_::threads
LogThreadedFileCtx * threads
Definition: util-logopenfile.h:79
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
ThreadLogFileHashEntry::thread_id
uint64_t thread_id
Definition: util-logopenfile.h:51
conf.h
SC_OK
@ SC_OK
Definition: util-error.h:27
SCBasename
const char * SCBasename(const char *path)
Definition: util-path.c:249
LOGFILE_TYPE_UNIX_DGRAM
@ LOGFILE_TYPE_UNIX_DGRAM
Definition: util-logopenfile.h:40
LogFileTypeCtx_::thread_data
void * thread_data
Definition: util-logopenfile.h:68
SCLogOpenThreadedFile
bool SCLogOpenThreadedFile(const char *log_path, const char *append, LogFileCtx *parent_ctx)
Definition: util-logopenfile.c:361
LOGFILE_TYPE_UNIX_STREAM
@ LOGFILE_TYPE_UNIX_STREAM
Definition: util-logopenfile.h:41
MemBuffer_
Definition: util-buffer.h:27
LogFileCtx_::is_regular
uint8_t is_regular
Definition: util-logopenfile.h:147
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
SCMutexInit
#define SCMutexInit(mut, mutattrs)
Definition: threads-debug.h:116
LogFileCtx_::buffer_size
uint32_t buffer_size
Definition: util-logopenfile.h:112
LogFileCtx_::bytes_since_last_flush
uint64_t bytes_since_last_flush
Definition: util-logopenfile.h:165
SCGetThreadIdLong
#define SCGetThreadIdLong(...)
Definition: threads.h:255
ConfNodeLookupChild
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
Definition: conf.c:781
LogFileCtx_::parent
struct LogFileCtx_ * parent
Definition: util-logopenfile.h:99
util-conf.h
LogThreadedFileCtx_
Definition: util-logopenfile.h:59
LogFileEnsureExists
LogFileCtx * LogFileEnsureExists(ThreadId thread_id, LogFileCtx *parent_ctx)
LogFileEnsureExists() Ensure a log file context for the thread exists.
Definition: util-logopenfile.c:749
suricata-common.h
LogFileTypeCtx_::init_data
void * init_data
Definition: util-logopenfile.h:67
util-path.h
LogFileCtx_::output_errors
uint64_t output_errors
Definition: util-logopenfile.h:162
ThreadLogFileHashEntry
Definition: util-logopenfile.h:48
ConfNode_::name
char * name
Definition: conf.h:33
LogFileCtx_::Flush
void(* Flush)(struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:89
PathIsAbsolute
int PathIsAbsolute(const char *path)
Check if a path is absolute.
Definition: util-path.c:44
LogFileCtx_::entry
ThreadLogFileHashEntry * entry
Definition: util-logopenfile.h:100
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:912
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
LogFileCtx_::rotate_time
time_t rotate_time
Definition: util-logopenfile.h:124
SCEveFileType_::Deinit
void(* Deinit)(void *init_data)
Final call to deinitialize this filetype.
Definition: output-eve.h:167
FatalError
#define FatalError(...)
Definition: util-debug.h:502
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:173
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
ConfigGetLogDirectory
const char * ConfigGetLogDirectory(void)
Definition: util-conf.c:38
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-logopenfile.h
LOGFILE_ROTATE_INTERVAL
#define LOGFILE_ROTATE_INTERVAL
Definition: util-logopenfile.h:172
ConfValIsFalse
int ConfValIsFalse(const char *val)
Check if a value is false.
Definition: conf.c:561
LogThreadedFileCtx_::mutex
SCMutex mutex
Definition: util-logopenfile.h:60
sc_errno
thread_local SCError sc_errno
Definition: util-error.c:31
LogFileCtx_::prefix
char * prefix
Definition: util-logopenfile.h:131
HashTableInit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hash.c:35
sc_log_global_log_level
SCLogLevel sc_log_global_log_level
Holds the global log level. Is the same as sc_log_config->log_level.
Definition: util-debug.c:101
suricata.h
MemBufferWriteString
void MemBufferWriteString(MemBuffer *dst, const char *fmt,...)
Definition: util-buffer.c:130
LogFileCtx_::flags
uint8_t flags
Definition: util-logopenfile.h:140
LogFileCtx_::Close
void(* Close)(struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:88
MEMBUFFER_BUFFER
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:51
SCEveFileType_::ThreadInit
int(* ThreadInit)(const void *init_data, const ThreadId thread_id, void **thread_data)
Initialize thread specific data.
Definition: output-eve.h:125
LogFileTypeCtx_::filetype
SCEveFileType * filetype
Definition: util-logopenfile.h:66
util-misc.h
LogThreadedFileCtx_::ht
HashTable * ht
Definition: util-logopenfile.h:61
OutputUnregisterFileRotationFlag
void OutputUnregisterFileRotationFlag(int *flag)
Unregister a file rotation flag.
Definition: output.c:687
MEMBUFFER_OFFSET
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:56
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
SCMutexDestroy
#define SCMutexDestroy
Definition: threads-debug.h:120
LogFileCtx_::fp
FILE * fp
Definition: util-logopenfile.h:74
LOGFILE_TYPE_FILETYPE
@ LOGFILE_TYPE_FILETYPE
Definition: util-logopenfile.h:44
output.h
LogFileCtx_::threaded
bool threaded
Definition: util-logopenfile.h:98
SCCreateDirectoryTree
int SCCreateDirectoryTree(const char *path, const bool final)
Recursively create a directory.
Definition: util-path.c:137
LogFileCtx_::filemode
uint32_t filemode
Definition: util-logopenfile.h:109
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:809