suricata
util-logopenfile.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mike Pomraning <mpomraning@qualys.com>
22  */
23 
24 #ifndef __UTIL_LOGOPENFILE_H__
25 #define __UTIL_LOGOPENFILE_H__
26 
27 #include "threads.h"
28 #include "conf.h" /* ConfNode */
29 #include "util-buffer.h"
30 
31 #ifdef HAVE_LIBHIREDIS
32 #include "util-log-redis.h"
33 #endif /* HAVE_LIBHIREDIS */
34 
35 #include "suricata-plugin.h"
36 
44 };
45 
46 typedef struct SyslogSetup_ {
49 
50 struct LogFileCtx_;
51 typedef struct LogThreadedFileCtx_ {
55  char *append;
57 
58 typedef struct LogFilePluginCtx_ {
60  void *init_data;
61  void *thread_data;
63 
64 /** Global structure for Output Context */
65 typedef struct LogFileCtx_ {
66  union {
67  FILE *fp;
68  void *plugin_data;
69 #ifdef HAVE_LIBHIREDIS
70  void *redis;
71 #endif
72  };
74 
75  union {
76 #ifdef HAVE_LIBHIREDIS
77  RedisSetup redis_setup;
78 #endif
79  };
80 
81  int (*Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp);
82  void (*Close)(struct LogFileCtx_ *fp);
83 
85 
86  /** It will be locked if the log/alert
87  * record cannot be written to the file in one call */
89 
90  /** When threaded, track of the parent and thread id */
91  bool threaded;
93  int id;
94 
95  /** the type of file */
96  enum LogFileType type;
97 
98  /** The name of the file */
99  char *filename;
100 
101  /** File permissions */
102  uint32_t filemode;
103 
104  /** Suricata sensor name */
105  char *sensor_name;
106 
107  /** Handle auto-connecting / reconnecting sockets */
108  int is_sock;
110  uint64_t reconn_timer;
111 
112  /** The next time to rotate log file, if rotate interval is
113  specified. */
114  time_t rotate_time;
115 
116  /** The interval to rotate the log file */
117  uint64_t rotate_interval;
118 
119  /**< Used by some alert loggers like the unified ones that append
120  * the date onto the end of files. */
121  char *prefix;
122  size_t prefix_len;
123 
124  /** Generic size_limit and size_current
125  * They must be common to the threads accessing the same file */
126  uint64_t size_limit; /**< file size limit */
127  uint64_t size_current; /**< file current size */
128 
129  /* flag to avoid multiple threads printing the same stats */
130  uint8_t flags;
131 
132  /* flags to set when sending over a socket */
133  uint8_t send_flags;
134 
135  /* Flag if file is a regular file or not. Only regular files
136  * allow for rotation. */
137  uint8_t is_regular;
138 
139  /* JSON flags */
140  size_t json_flags; /* passed to json_dump_callback() */
141 
142  /* Flag set when file rotation notification is received. */
144 
145  /* Set to true if the filename should not be timestamped. */
146  bool nostamp;
147 
148  /* if set to true EVE will add a pcap file record */
150 
151  /* Socket types may need to drop events to keep from blocking
152  * Suricata. */
153  uint64_t dropped;
154 
155  uint64_t output_errors;
157 
158 /* Min time (msecs) before trying to reconnect a Unix domain socket */
159 #define LOGFILE_RECONN_MIN_TIME 500
160 
161 /* flags for LogFileCtx */
162 #define LOGFILE_HEADER_WRITTEN 0x01
163 #define LOGFILE_ALERTS_PRINTED 0x02
164 #define LOGFILE_ROTATE_INTERVAL 0x04
165 
168 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer);
169 
170 LogFileCtx *LogFileEnsureExists(LogFileCtx *lf_ctx, int thread_id);
171 int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int);
174  const char *log_path, const char *append, LogFileCtx *parent_ctx, int slot_count);
175 
176 #endif /* __UTIL_LOGOPENFILE_H__ */
LogFileCtx_::rotation_flag
int rotation_flag
Definition: util-logopenfile.h:143
suricata-plugin.h
LogFileCtx_::prefix_len
size_t prefix_len
Definition: util-logopenfile.h:122
SyslogSetup_::alert_syslog_level
int alert_syslog_level
Definition: util-logopenfile.h:47
LogThreadedFileCtx_::append
char * append
Definition: util-logopenfile.h:55
LogFileCtx
struct LogFileCtx_ LogFileCtx
LOGFILE_TYPE_REDIS
@ LOGFILE_TYPE_REDIS
Definition: util-logopenfile.h:41
LogFileCtx_::sensor_name
char * sensor_name
Definition: util-logopenfile.h:105
LogFileCtx_::reconn_timer
uint64_t reconn_timer
Definition: util-logopenfile.h:110
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:88
LogThreadedFileCtx_::lf_slots
struct LogFileCtx_ ** lf_slots
Definition: util-logopenfile.h:54
threads.h
LogFileCtx_::json_flags
size_t json_flags
Definition: util-logopenfile.h:140
LogFilePluginCtx_::init_data
void * init_data
Definition: util-logopenfile.h:60
LogFilePluginCtx_::thread_data
void * thread_data
Definition: util-logopenfile.h:61
SyslogSetup_
Definition: util-logopenfile.h:46
LogFileCtx_::id
int id
Definition: util-logopenfile.h:93
LogFileCtx_
Definition: util-logopenfile.h:65
LogThreadedFileCtx
struct LogThreadedFileCtx_ LogThreadedFileCtx
LOGFILE_TYPE_NOTSET
@ LOGFILE_TYPE_NOTSET
Definition: util-logopenfile.h:43
util-log-redis.h
LogFileCtx_::size_current
uint64_t size_current
Definition: util-logopenfile.h:127
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:81
LogFileCtx_::filename
char * filename
Definition: util-logopenfile.h:99
LogFileCtx_::size_limit
uint64_t size_limit
Definition: util-logopenfile.h:126
LogFileCtx_::plugin
LogFilePluginCtx plugin
Definition: util-logopenfile.h:84
SyslogSetup
struct SyslogSetup_ SyslogSetup
LogFileCtx_::send_flags
uint8_t send_flags
Definition: util-logopenfile.h:133
LogFileCtx_::sock_type
int sock_type
Definition: util-logopenfile.h:109
LogFileEnsureExists
LogFileCtx * LogFileEnsureExists(LogFileCtx *lf_ctx, int thread_id)
LogFileEnsureExists() Ensure a log file context for the thread exists.
Definition: util-logopenfile.c:664
LogFileCtx_::rotate_interval
uint64_t rotate_interval
Definition: util-logopenfile.h:117
LogFileCtx_::is_sock
int is_sock
Definition: util-logopenfile.h:108
LogFileCtx_::dropped
uint64_t dropped
Definition: util-logopenfile.h:153
SCLogOpenThreadedFile
bool SCLogOpenThreadedFile(const char *log_path, const char *append, LogFileCtx *parent_ctx, int slot_count)
Definition: util-logopenfile.c:329
LogFileCtx_::type
enum LogFileType type
Definition: util-logopenfile.h:96
LOGFILE_TYPE_FILE
@ LOGFILE_TYPE_FILE
Definition: util-logopenfile.h:38
LogFileCtx_::threads
LogThreadedFileCtx * threads
Definition: util-logopenfile.h:73
LOGFILE_TYPE_PLUGIN
@ LOGFILE_TYPE_PLUGIN
Definition: util-logopenfile.h:42
conf.h
LOGFILE_TYPE_UNIX_DGRAM
@ LOGFILE_TYPE_UNIX_DGRAM
Definition: util-logopenfile.h:39
LOGFILE_TYPE_UNIX_STREAM
@ LOGFILE_TYPE_UNIX_STREAM
Definition: util-logopenfile.h:40
MemBuffer_
Definition: util-buffer.h:27
LogFileCtx_::is_regular
uint8_t is_regular
Definition: util-logopenfile.h:137
LogFileWrite
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
Definition: util-logopenfile.c:898
LogFileCtx_::parent
struct LogFileCtx_ * parent
Definition: util-logopenfile.h:92
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:830
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:433
LogFilePluginCtx_
Definition: util-logopenfile.h:58
LogThreadedFileCtx_
Definition: util-logopenfile.h:51
LogFilePluginCtx_::plugin
SCEveFileType * plugin
Definition: util-logopenfile.h:59
LogFileCtx_::output_errors
uint64_t output_errors
Definition: util-logopenfile.h:155
LogThreadedFileCtx_::slot_count
int slot_count
Definition: util-logopenfile.h:52
LogFileCtx_::rotate_time
time_t rotate_time
Definition: util-logopenfile.h:114
LogFileCtx_::nostamp
bool nostamp
Definition: util-logopenfile.h:146
ConfNode_
Definition: conf.h:32
SCConfLogReopen
int SCConfLogReopen(LogFileCtx *)
Reopen a regular log file with the side-affect of truncating it.
Definition: util-logopenfile.c:614
util-buffer.h
LogThreadedFileCtx_::mutex
SCMutex mutex
Definition: util-logopenfile.h:53
LogFileCtx_::prefix
char * prefix
Definition: util-logopenfile.h:121
LogFileCtx_::is_pcap_offline
bool is_pcap_offline
Definition: util-logopenfile.h:149
LogFilePluginCtx
struct LogFilePluginCtx_ LogFilePluginCtx
LogFileType
LogFileType
Definition: util-logopenfile.h:37
LogFileCtx_::flags
uint8_t flags
Definition: util-logopenfile.h:130
LogFileCtx_::Close
void(* Close)(struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:82
LogFileCtx_::fp
FILE * fp
Definition: util-logopenfile.h:67
SCMutex
#define SCMutex
Definition: threads-debug.h:114
LogFileCtx_::plugin_data
void * plugin_data
Definition: util-logopenfile.h:68
LogFileCtx_::threaded
bool threaded
Definition: util-logopenfile.h:91
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:645
SCEveFileType_
Definition: suricata-plugin.h:47
LogFileCtx_::filemode
uint32_t filemode
Definition: util-logopenfile.h:102