suricata
util-logopenfile.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mike Pomraning <mpomraning@qualys.com>
22  */
23 
24 #ifndef __UTIL_LOGOPENFILE_H__
25 #define __UTIL_LOGOPENFILE_H__
26 
27 #include "conf.h" /* ConfNode */
28 #include "util-buffer.h"
29 
30 #ifdef HAVE_LIBHIREDIS
31 #include "util-log-redis.h"
32 #endif /* HAVE_LIBHIREDIS */
33 
34 #include "suricata-plugin.h"
35 
43 };
44 
45 typedef struct SyslogSetup_ {
48 
49 struct LogFileCtx_;
50 typedef struct LogThreadedFileCtx_ {
54  char *append;
56 
57 typedef struct LogFilePluginCtx_ {
59  void *init_data;
60  void *thread_data;
62 
63 /** Global structure for Output Context */
64 typedef struct LogFileCtx_ {
65  union {
66  FILE *fp;
67  void *plugin_data;
68 #ifdef HAVE_LIBHIREDIS
69  void *redis;
70 #endif
71  };
73 
74  union {
75 #ifdef HAVE_LIBHIREDIS
76  RedisSetup redis_setup;
77 #endif
78  };
79 
80  int (*Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp);
81  void (*Close)(struct LogFileCtx_ *fp);
82 
84 
85  /** It will be locked if the log/alert
86  * record cannot be written to the file in one call */
88 
89  /** When threaded, track of the parent and thread id */
90  bool threaded;
92  int id;
93 
94  /** the type of file */
95  enum LogFileType type;
96 
97  /** The name of the file */
98  char *filename;
99 
100  /** File permissions */
101  uint32_t filemode;
102 
103  /** Suricata sensor name */
104  char *sensor_name;
105 
106  /** Handle auto-connecting / reconnecting sockets */
107  int is_sock;
109  uint64_t reconn_timer;
110 
111  /** The next time to rotate log file, if rotate interval is
112  specified. */
113  time_t rotate_time;
114 
115  /** The interval to rotate the log file */
116  uint64_t rotate_interval;
117 
118  /**< Used by some alert loggers like the unified ones that append
119  * the date onto the end of files. */
120  char *prefix;
121  size_t prefix_len;
122 
123  /** Generic size_limit and size_current
124  * They must be common to the threads accessing the same file */
125  uint64_t size_limit; /**< file size limit */
126  uint64_t size_current; /**< file current size */
127 
128  /* flag to avoid multiple threads printing the same stats */
129  uint8_t flags;
130 
131  /* flags to set when sending over a socket */
132  uint8_t send_flags;
133 
134  /* Flag if file is a regular file or not. Only regular files
135  * allow for rotation. */
136  uint8_t is_regular;
137 
138  /* JSON flags */
139  size_t json_flags; /* passed to json_dump_callback() */
140 
141  /* Flag set when file rotation notification is received. */
143 
144  /* Set to true if the filename should not be timestamped. */
145  bool nostamp;
146 
147  /* if set to true EVE will add a pcap file record */
149 
150  /* Socket types may need to drop events to keep from blocking
151  * Suricata. */
152  uint64_t dropped;
153 
154  uint64_t output_errors;
156 
157 /* Min time (msecs) before trying to reconnect a Unix domain socket */
158 #define LOGFILE_RECONN_MIN_TIME 500
159 
160 /* flags for LogFileCtx */
161 #define LOGFILE_HEADER_WRITTEN 0x01
162 #define LOGFILE_ALERTS_PRINTED 0x02
163 #define LOGFILE_ROTATE_INTERVAL 0x04
164 
167 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer);
168 
169 LogFileCtx *LogFileEnsureExists(LogFileCtx *lf_ctx, int thread_id);
170 int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int);
173  const char *log_path, const char *append, LogFileCtx *parent_ctx, int slot_count);
174 
175 #endif /* __UTIL_LOGOPENFILE_H__ */
LogFileCtx_::rotation_flag
int rotation_flag
Definition: util-logopenfile.h:142
suricata-plugin.h
LogFileCtx_::prefix_len
size_t prefix_len
Definition: util-logopenfile.h:121
SyslogSetup_::alert_syslog_level
int alert_syslog_level
Definition: util-logopenfile.h:46
LogThreadedFileCtx_::append
char * append
Definition: util-logopenfile.h:54
LogFileCtx
struct LogFileCtx_ LogFileCtx
LOGFILE_TYPE_REDIS
@ LOGFILE_TYPE_REDIS
Definition: util-logopenfile.h:40
LogFileCtx_::sensor_name
char * sensor_name
Definition: util-logopenfile.h:104
LogFileCtx_::reconn_timer
uint64_t reconn_timer
Definition: util-logopenfile.h:109
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:87
LogThreadedFileCtx_::lf_slots
struct LogFileCtx_ ** lf_slots
Definition: util-logopenfile.h:53
LogFileCtx_::json_flags
size_t json_flags
Definition: util-logopenfile.h:139
LogFilePluginCtx_::init_data
void * init_data
Definition: util-logopenfile.h:59
LogFilePluginCtx_::thread_data
void * thread_data
Definition: util-logopenfile.h:60
SyslogSetup_
Definition: util-logopenfile.h:45
LogFileCtx_::id
int id
Definition: util-logopenfile.h:92
LogFileCtx_
Definition: util-logopenfile.h:64
LogThreadedFileCtx
struct LogThreadedFileCtx_ LogThreadedFileCtx
LOGFILE_TYPE_NOTSET
@ LOGFILE_TYPE_NOTSET
Definition: util-logopenfile.h:42
util-log-redis.h
LogFileCtx_::size_current
uint64_t size_current
Definition: util-logopenfile.h:126
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:80
LogFileCtx_::filename
char * filename
Definition: util-logopenfile.h:98
LogFileCtx_::size_limit
uint64_t size_limit
Definition: util-logopenfile.h:125
LogFileCtx_::plugin
LogFilePluginCtx plugin
Definition: util-logopenfile.h:83
SyslogSetup
struct SyslogSetup_ SyslogSetup
LogFileCtx_::send_flags
uint8_t send_flags
Definition: util-logopenfile.h:132
LogFileCtx_::sock_type
int sock_type
Definition: util-logopenfile.h:108
LogFileEnsureExists
LogFileCtx * LogFileEnsureExists(LogFileCtx *lf_ctx, int thread_id)
LogFileEnsureExists() Ensure a log file context for the thread exists.
Definition: util-logopenfile.c:656
LogFileCtx_::rotate_interval
uint64_t rotate_interval
Definition: util-logopenfile.h:116
LogFileCtx_::is_sock
int is_sock
Definition: util-logopenfile.h:107
LogFileCtx_::dropped
uint64_t dropped
Definition: util-logopenfile.h:152
SCLogOpenThreadedFile
bool SCLogOpenThreadedFile(const char *log_path, const char *append, LogFileCtx *parent_ctx, int slot_count)
Definition: util-logopenfile.c:323
LogFileCtx_::type
enum LogFileType type
Definition: util-logopenfile.h:95
LOGFILE_TYPE_FILE
@ LOGFILE_TYPE_FILE
Definition: util-logopenfile.h:37
LogFileCtx_::threads
LogThreadedFileCtx * threads
Definition: util-logopenfile.h:72
LOGFILE_TYPE_PLUGIN
@ LOGFILE_TYPE_PLUGIN
Definition: util-logopenfile.h:41
conf.h
LOGFILE_TYPE_UNIX_DGRAM
@ LOGFILE_TYPE_UNIX_DGRAM
Definition: util-logopenfile.h:38
LOGFILE_TYPE_UNIX_STREAM
@ LOGFILE_TYPE_UNIX_STREAM
Definition: util-logopenfile.h:39
MemBuffer_
Definition: util-buffer.h:27
LogFileCtx_::is_regular
uint8_t is_regular
Definition: util-logopenfile.h:136
LogFileWrite
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
Definition: util-logopenfile.c:885
LogFileCtx_::parent
struct LogFileCtx_ * parent
Definition: util-logopenfile.h:91
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:817
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:423
LogFilePluginCtx_
Definition: util-logopenfile.h:57
LogThreadedFileCtx_
Definition: util-logopenfile.h:50
LogFilePluginCtx_::plugin
SCEveFileType * plugin
Definition: util-logopenfile.h:58
LogFileCtx_::output_errors
uint64_t output_errors
Definition: util-logopenfile.h:154
LogThreadedFileCtx_::slot_count
int slot_count
Definition: util-logopenfile.h:51
LogFileCtx_::rotate_time
time_t rotate_time
Definition: util-logopenfile.h:113
LogFileCtx_::nostamp
bool nostamp
Definition: util-logopenfile.h:145
ConfNode_
Definition: conf.h:32
SCConfLogReopen
int SCConfLogReopen(LogFileCtx *)
Reopen a regular log file with the side-affect of truncating it.
Definition: util-logopenfile.c:606
util-buffer.h
LogThreadedFileCtx_::mutex
SCMutex mutex
Definition: util-logopenfile.h:52
LogFileCtx_::prefix
char * prefix
Definition: util-logopenfile.h:120
LogFileCtx_::is_pcap_offline
bool is_pcap_offline
Definition: util-logopenfile.h:148
LogFilePluginCtx
struct LogFilePluginCtx_ LogFilePluginCtx
LogFileType
LogFileType
Definition: util-logopenfile.h:36
LogFileCtx_::flags
uint8_t flags
Definition: util-logopenfile.h:129
LogFileCtx_::Close
void(* Close)(struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:81
LogFileCtx_::fp
FILE * fp
Definition: util-logopenfile.h:66
SCMutex
#define SCMutex
Definition: threads-debug.h:114
LogFileCtx_::plugin_data
void * plugin_data
Definition: util-logopenfile.h:67
LogFileCtx_::threaded
bool threaded
Definition: util-logopenfile.h:90
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:637
SCEveFileType_
Definition: suricata-plugin.h:47
LogFileCtx_::filemode
uint32_t filemode
Definition: util-logopenfile.h:101