suricata
util-logopenfile.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mike Pomraning <mpomraning@qualys.com>
22  */
23 
24 #ifndef __UTIL_LOGOPENFILE_H__
25 #define __UTIL_LOGOPENFILE_H__
26 
27 #include "conf.h" /* ConfNode */
28 #include "tm-modules.h" /* LogFileCtx */
29 #include "util-buffer.h"
30 
31 #ifdef HAVE_LIBHIREDIS
32 #include "util-log-redis.h"
33 #endif /* HAVE_LIBHIREDIS */
34 
35 
36 typedef struct {
37  uint16_t fileno;
38 } PcieFile;
39 
45 
46 typedef struct SyslogSetup_ {
48 } SyslogSetup;
49 
50 
51 /** Global structure for Output Context */
52 typedef struct LogFileCtx_ {
53  union {
54  FILE *fp;
56 #ifdef HAVE_LIBHIREDIS
57  void *redis;
58 #endif
59  };
60 
61  union {
63 #ifdef HAVE_LIBHIREDIS
64  RedisSetup redis_setup;
65 #endif
66  };
67 
68  int (*Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp);
69  void (*Close)(struct LogFileCtx_ *fp);
70 
71  /** It will be locked if the log/alert
72  * record cannot be written to the file in one call */
74 
75  /** the type of file */
77 
78  /** The name of the file */
79  char *filename;
80 
81  /** File permissions */
82  uint32_t filemode;
83 
84  /** Suricata sensor name */
85  char *sensor_name;
86 
87  /** Handle auto-connecting / reconnecting sockets */
88  int is_sock;
89  int sock_type;
90  uint64_t reconn_timer;
91 
92  /** The next time to rotate log file, if rotate interval is
93  specified. */
94  time_t rotate_time;
95 
96  /** The interval to rotate the log file */
97  uint64_t rotate_interval;
98 
99  /**< Used by some alert loggers like the unified ones that append
100  * the date onto the end of files. */
101  char *prefix;
102  size_t prefix_len;
103 
104  /** Generic size_limit and size_current
105  * They must be common to the threads accesing the same file */
106  uint64_t size_limit; /**< file size limit */
107  uint64_t size_current; /**< file current size */
108 
109  /* flag to avoid multiple threads printing the same stats */
110  uint8_t flags;
111 
112  /* flags to set when sending over a socket */
113  uint8_t send_flags;
114 
115  /* Flag if file is a regular file or not. Only regular files
116  * allow for rotataion. */
117  uint8_t is_regular;
118 
119  /* JSON flags */
120  size_t json_flags; /* passed to json_dump_callback() */
121 
122  /* Flag set when file rotation notification is received. */
124 
125  /* Set to true if the filename should not be timestamped. */
126  bool nostamp;
127 
128  /* if set to true EVE will add a pcap file record */
130 
131  /* Socket types may need to drop events to keep from blocking
132  * Suricata. */
133  uint64_t dropped;
134 } LogFileCtx;
135 
136 /* Min time (msecs) before trying to reconnect a Unix domain socket */
137 #define LOGFILE_RECONN_MIN_TIME 500
138 
139 /* flags for LogFileCtx */
140 #define LOGFILE_HEADER_WRITTEN 0x01
141 #define LOGFILE_ALERTS_PRINTED 0x02
142 #define LOGFILE_ROTATE_INTERVAL 0x04
143 
146 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer);
147 
148 int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int);
150 
151 #endif /* __UTIL_LOGOPENFILE_H__ */
#define SCMutex
PcieFile * pcie_fp
uint16_t fileno
time_t rotate_time
SyslogSetup syslog_setup
LogFileType
uint8_t is_regular
uint64_t size_current
struct SyslogSetup_ SyslogSetup
int LogFileFreeCtx(LogFileCtx *)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
void(* Close)(struct LogFileCtx_ *fp)
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
int SCConfLogReopen(LogFileCtx *)
Reopen a regular log file with the side-affect of truncating it.
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
uint8_t type
SCMutex fp_mutex
uint32_t filemode
struct LogFileCtx_ LogFileCtx
char * sensor_name
uint64_t rotate_interval
Definition: conf.h:32
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int)
open a generic output "log file", which may be a regular file or a socket
uint8_t send_flags
uint64_t reconn_timer
uint64_t size_limit
uint64_t dropped