suricata
util-logopenfile.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mike Pomraning <mpomraning@qualys.com>
22  */
23 
24 #ifndef __UTIL_LOGOPENFILE_H__
25 #define __UTIL_LOGOPENFILE_H__
26 
27 #include "conf.h" /* ConfNode */
28 #include "util-buffer.h"
29 
30 #ifdef HAVE_LIBHIREDIS
31 #include "util-log-redis.h"
32 #endif /* HAVE_LIBHIREDIS */
33 
34 #include "suricata-plugin.h"
35 
36 typedef struct {
37  uint16_t fileno;
38 } PcieFile;
39 
46 
47 typedef struct SyslogSetup_ {
50 
51 struct LogFileCtx_;
52 typedef struct LogThreadedFileCtx_ {
56  char *append;
58 
59 /** Global structure for Output Context */
60 typedef struct LogFileCtx_ {
61  union {
62  FILE *fp;
65  void *plugin_data;
66 #ifdef HAVE_LIBHIREDIS
67  void *redis;
68 #endif
69  };
70 
71  union {
73 #ifdef HAVE_LIBHIREDIS
74  RedisSetup redis_setup;
75 #endif
76  };
77 
78  int (*Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp);
79  void (*Close)(struct LogFileCtx_ *fp);
80 
82 
83  /** It will be locked if the log/alert
84  * record cannot be written to the file in one call */
86 
87  /** When threaded, track of the parent and thread id */
88  bool threaded;
90  int id;
91 
92  /** the type of file */
93  enum LogFileType type;
94 
95  /** The name of the file */
96  char *filename;
97 
98  /** File permissions */
99  uint32_t filemode;
100 
101  /** Suricata sensor name */
102  char *sensor_name;
103 
104  /** Handle auto-connecting / reconnecting sockets */
105  int is_sock;
107  uint64_t reconn_timer;
108 
109  /** The next time to rotate log file, if rotate interval is
110  specified. */
111  time_t rotate_time;
112 
113  /** The interval to rotate the log file */
114  uint64_t rotate_interval;
115 
116  /**< Used by some alert loggers like the unified ones that append
117  * the date onto the end of files. */
118  char *prefix;
119  size_t prefix_len;
120 
121  /** Generic size_limit and size_current
122  * They must be common to the threads accessing the same file */
123  uint64_t size_limit; /**< file size limit */
124  uint64_t size_current; /**< file current size */
125 
126  /* flag to avoid multiple threads printing the same stats */
127  uint8_t flags;
128 
129  /* flags to set when sending over a socket */
130  uint8_t send_flags;
131 
132  /* Flag if file is a regular file or not. Only regular files
133  * allow for rotation. */
134  uint8_t is_regular;
135 
136  /* JSON flags */
137  size_t json_flags; /* passed to json_dump_callback() */
138 
139  /* Flag set when file rotation notification is received. */
141 
142  /* Set to true if the filename should not be timestamped. */
143  bool nostamp;
144 
145  /* if set to true EVE will add a pcap file record */
147 
148  /* Socket types may need to drop events to keep from blocking
149  * Suricata. */
150  uint64_t dropped;
151 
152  uint64_t output_errors;
154 
155 /* Min time (msecs) before trying to reconnect a Unix domain socket */
156 #define LOGFILE_RECONN_MIN_TIME 500
157 
158 /* flags for LogFileCtx */
159 #define LOGFILE_HEADER_WRITTEN 0x01
160 #define LOGFILE_ALERTS_PRINTED 0x02
161 #define LOGFILE_ROTATE_INTERVAL 0x04
162 
165 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer);
166 
167 LogFileCtx *LogFileEnsureExists(LogFileCtx *lf_ctx, int thread_id);
168 int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int);
170 
171 #endif /* __UTIL_LOGOPENFILE_H__ */
PcieFile
Definition: util-logopenfile.h:36
LogFileCtx_::rotation_flag
int rotation_flag
Definition: util-logopenfile.h:140
suricata-plugin.h
LogFileCtx_::prefix_len
size_t prefix_len
Definition: util-logopenfile.h:119
SyslogSetup_::alert_syslog_level
int alert_syslog_level
Definition: util-logopenfile.h:48
LogThreadedFileCtx_::append
char * append
Definition: util-logopenfile.h:56
LogFileCtx
struct LogFileCtx_ LogFileCtx
LOGFILE_TYPE_REDIS
@ LOGFILE_TYPE_REDIS
Definition: util-logopenfile.h:44
LogFileCtx_::sensor_name
char * sensor_name
Definition: util-logopenfile.h:102
LogFileCtx_::reconn_timer
uint64_t reconn_timer
Definition: util-logopenfile.h:107
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:85
LogFileCtx_::pcie_fp
PcieFile * pcie_fp
Definition: util-logopenfile.h:63
LogThreadedFileCtx_::lf_slots
struct LogFileCtx_ ** lf_slots
Definition: util-logopenfile.h:55
LogFileCtx_::json_flags
size_t json_flags
Definition: util-logopenfile.h:137
SyslogSetup_
Definition: util-logopenfile.h:47
LogFileCtx_::id
int id
Definition: util-logopenfile.h:90
LogFileCtx_
Definition: util-logopenfile.h:60
LOGFILE_TYPE_SYSLOG
@ LOGFILE_TYPE_SYSLOG
Definition: util-logopenfile.h:41
LogThreadedFileCtx
struct LogThreadedFileCtx_ LogThreadedFileCtx
util-log-redis.h
LogFileCtx_::size_current
uint64_t size_current
Definition: util-logopenfile.h:124
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:78
LogFileCtx_::filename
char * filename
Definition: util-logopenfile.h:96
LogFileCtx_::size_limit
uint64_t size_limit
Definition: util-logopenfile.h:123
LogFileCtx_::plugin
SCPluginFileType * plugin
Definition: util-logopenfile.h:81
SyslogSetup
struct SyslogSetup_ SyslogSetup
LogFileCtx_::send_flags
uint8_t send_flags
Definition: util-logopenfile.h:130
LogFileCtx_::sock_type
int sock_type
Definition: util-logopenfile.h:106
LogFileEnsureExists
LogFileCtx * LogFileEnsureExists(LogFileCtx *lf_ctx, int thread_id)
LogFileEnsureExists() Ensure a log file context for the thread exists.
Definition: util-logopenfile.c:659
LogFileCtx_::rotate_interval
uint64_t rotate_interval
Definition: util-logopenfile.h:114
LogFileCtx_::is_sock
int is_sock
Definition: util-logopenfile.h:105
LogFileCtx_::dropped
uint64_t dropped
Definition: util-logopenfile.h:150
LogFileCtx_::type
enum LogFileType type
Definition: util-logopenfile.h:93
LOGFILE_TYPE_FILE
@ LOGFILE_TYPE_FILE
Definition: util-logopenfile.h:40
LogFileCtx_::threads
LogThreadedFileCtx * threads
Definition: util-logopenfile.h:64
LOGFILE_TYPE_PLUGIN
@ LOGFILE_TYPE_PLUGIN
Definition: util-logopenfile.h:45
conf.h
LogFileCtx_::syslog_setup
SyslogSetup syslog_setup
Definition: util-logopenfile.h:72
LOGFILE_TYPE_UNIX_DGRAM
@ LOGFILE_TYPE_UNIX_DGRAM
Definition: util-logopenfile.h:42
LOGFILE_TYPE_UNIX_STREAM
@ LOGFILE_TYPE_UNIX_STREAM
Definition: util-logopenfile.h:43
MemBuffer_
Definition: util-buffer.h:27
LogFileCtx_::is_regular
uint8_t is_regular
Definition: util-logopenfile.h:134
LogFileWrite
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
Definition: util-logopenfile.c:867
LogFileCtx_::parent
struct LogFileCtx_ * parent
Definition: util-logopenfile.h:89
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:813
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:423
PcieFile::fileno
uint16_t fileno
Definition: util-logopenfile.h:37
LogThreadedFileCtx_
Definition: util-logopenfile.h:52
LogFileCtx_::output_errors
uint64_t output_errors
Definition: util-logopenfile.h:152
LogThreadedFileCtx_::slot_count
int slot_count
Definition: util-logopenfile.h:53
LogFileCtx_::rotate_time
time_t rotate_time
Definition: util-logopenfile.h:111
LogFileCtx_::nostamp
bool nostamp
Definition: util-logopenfile.h:143
SCPluginFileType_
Definition: suricata-plugin.h:49
ConfNode_
Definition: conf.h:32
SCConfLogReopen
int SCConfLogReopen(LogFileCtx *)
Reopen a regular log file with the side-affect of truncating it.
Definition: util-logopenfile.c:609
util-buffer.h
LogThreadedFileCtx_::mutex
SCMutex mutex
Definition: util-logopenfile.h:54
LogFileCtx_::prefix
char * prefix
Definition: util-logopenfile.h:118
LogFileCtx_::is_pcap_offline
bool is_pcap_offline
Definition: util-logopenfile.h:146
LogFileType
LogFileType
Definition: util-logopenfile.h:40
LogFileCtx_::flags
uint8_t flags
Definition: util-logopenfile.h:127
LogFileCtx_::Close
void(* Close)(struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:79
LogFileCtx_::fp
FILE * fp
Definition: util-logopenfile.h:62
SCMutex
#define SCMutex
Definition: threads-debug.h:114
LogFileCtx_::plugin_data
void * plugin_data
Definition: util-logopenfile.h:65
LogFileCtx_::threaded
bool threaded
Definition: util-logopenfile.h:88
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:640
LogFileCtx_::filemode
uint32_t filemode
Definition: util-logopenfile.h:99