suricata
util-logopenfile.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Mike Pomraning <mpomraning@qualys.com>
22  */
23 
24 #ifndef __UTIL_LOGOPENFILE_H__
25 #define __UTIL_LOGOPENFILE_H__
26 
27 #include "conf.h" /* ConfNode */
28 #include "tm-modules.h" /* LogFileCtx */
29 #include "util-buffer.h"
30 
31 #ifdef HAVE_LIBHIREDIS
32 #include "util-log-redis.h"
33 #endif /* HAVE_LIBHIREDIS */
34 
35 
36 typedef struct {
37  uint16_t fileno;
38 } PcieFile;
39 
45 
46 typedef struct SyslogSetup_ {
48 } SyslogSetup;
49 
50 
51 /** Global structure for Output Context */
52 typedef struct LogFileCtx_ {
53  union {
54  FILE *fp;
56 #ifdef HAVE_LIBHIREDIS
57  void *redis;
58 #endif
59  };
60 
61  union {
63 #ifdef HAVE_LIBHIREDIS
64  RedisSetup redis_setup;
65 #endif
66  };
67 
68  int (*Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp);
69  void (*Close)(struct LogFileCtx_ *fp);
70 
71  /** It will be locked if the log/alert
72  * record cannot be written to the file in one call */
74 
75  /** the type of file */
77 
78  /** The name of the file */
79  char *filename;
80 
81  /** File permissions */
82  uint32_t filemode;
83 
84  /** Suricata sensor name */
85  char *sensor_name;
86 
87  /** Handle auto-connecting / reconnecting sockets */
88  int is_sock;
89  int sock_type;
90  uint64_t reconn_timer;
91 
92  /** The next time to rotate log file, if rotate interval is
93  specified. */
94  time_t rotate_time;
95 
96  /** The interval to rotate the log file */
97  uint64_t rotate_interval;
98 
99  /**< Used by some alert loggers like the unified ones that append
100  * the date onto the end of files. */
101  char *prefix;
102  size_t prefix_len;
103 
104  /** Generic size_limit and size_current
105  * They must be common to the threads accesing the same file */
106  uint64_t size_limit; /**< file size limit */
107  uint64_t size_current; /**< file current size */
108 
109  /* flag to avoid multiple threads printing the same stats */
110  uint8_t flags;
111 
112  /* flags to set when sending over a socket */
113  uint8_t send_flags;
114 
115  /* Flag if file is a regular file or not. Only regular files
116  * allow for rotataion. */
117  uint8_t is_regular;
118 
119  /* JSON flags */
120  size_t json_flags; /* passed to json_dump_callback() */
121 
122  /* Flag set when file rotation notification is received. */
124 
125  /* Set to true if the filename should not be timestamped. */
126  bool nostamp;
127 
128  /* if set to true EVE will add a pcap file record */
130 
131  /* Socket types may need to drop events to keep from blocking
132  * Suricata. */
133  uint64_t dropped;
134 } LogFileCtx;
135 
136 /* Min time (msecs) before trying to reconnect a Unix domain socket */
137 #define LOGFILE_RECONN_MIN_TIME 500
138 
139 /* flags for LogFileCtx */
140 #define LOGFILE_HEADER_WRITTEN 0x01
141 #define LOGFILE_ALERTS_PRINTED 0x02
142 #define LOGFILE_ROTATE_INTERVAL 0x04
143 
146 int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer);
147 
148 int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int);
150 
151 #endif /* __UTIL_LOGOPENFILE_H__ */
PcieFile
Definition: util-logopenfile.h:36
LogFileCtx_::rotation_flag
int rotation_flag
Definition: util-logopenfile.h:123
LogFileCtx_::prefix_len
size_t prefix_len
Definition: util-logopenfile.h:102
SyslogSetup_::alert_syslog_level
int alert_syslog_level
Definition: util-logopenfile.h:47
LogFileCtx
struct LogFileCtx_ LogFileCtx
LOGFILE_TYPE_REDIS
@ LOGFILE_TYPE_REDIS
Definition: util-logopenfile.h:44
LogFileCtx_::sensor_name
char * sensor_name
Definition: util-logopenfile.h:85
LogFileCtx_::reconn_timer
uint64_t reconn_timer
Definition: util-logopenfile.h:90
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:73
LogFileCtx_::pcie_fp
PcieFile * pcie_fp
Definition: util-logopenfile.h:55
LogFileCtx_::json_flags
size_t json_flags
Definition: util-logopenfile.h:120
SyslogSetup_
Definition: util-logopenfile.h:46
LogFileCtx_
Definition: util-logopenfile.h:52
LOGFILE_TYPE_SYSLOG
@ LOGFILE_TYPE_SYSLOG
Definition: util-logopenfile.h:41
tm-modules.h
util-log-redis.h
LogFileCtx_::size_current
uint64_t size_current
Definition: util-logopenfile.h:107
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:68
LogFileCtx_::filename
char * filename
Definition: util-logopenfile.h:79
LogFileCtx_::size_limit
uint64_t size_limit
Definition: util-logopenfile.h:106
SyslogSetup
struct SyslogSetup_ SyslogSetup
LogFileCtx_::send_flags
uint8_t send_flags
Definition: util-logopenfile.h:113
LogFileCtx_::sock_type
int sock_type
Definition: util-logopenfile.h:89
LogFileCtx_::rotate_interval
uint64_t rotate_interval
Definition: util-logopenfile.h:97
LogFileCtx_::is_sock
int is_sock
Definition: util-logopenfile.h:88
LogFileCtx_::dropped
uint64_t dropped
Definition: util-logopenfile.h:133
LogFileCtx_::type
enum LogFileType type
Definition: util-logopenfile.h:76
LOGFILE_TYPE_FILE
@ LOGFILE_TYPE_FILE
Definition: util-logopenfile.h:40
conf.h
LogFileCtx_::syslog_setup
SyslogSetup syslog_setup
Definition: util-logopenfile.h:62
LOGFILE_TYPE_UNIX_DGRAM
@ LOGFILE_TYPE_UNIX_DGRAM
Definition: util-logopenfile.h:42
LOGFILE_TYPE_UNIX_STREAM
@ LOGFILE_TYPE_UNIX_STREAM
Definition: util-logopenfile.h:43
MemBuffer_
Definition: util-buffer.h:27
LogFileCtx_::is_regular
uint8_t is_regular
Definition: util-logopenfile.h:117
LogFileWrite
int LogFileWrite(LogFileCtx *file_ctx, MemBuffer *buffer)
Definition: util-logopenfile.c:571
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:539
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *, const char *, int)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:305
PcieFile::fileno
uint16_t fileno
Definition: util-logopenfile.h:37
LogFileCtx_::rotate_time
time_t rotate_time
Definition: util-logopenfile.h:94
LogFileCtx_::nostamp
bool nostamp
Definition: util-logopenfile.h:126
ConfNode_
Definition: conf.h:32
SCConfLogReopen
int SCConfLogReopen(LogFileCtx *)
Reopen a regular log file with the side-affect of truncating it.
Definition: util-logopenfile.c:486
util-buffer.h
LogFileCtx_::prefix
char * prefix
Definition: util-logopenfile.h:101
LogFileCtx_::is_pcap_offline
bool is_pcap_offline
Definition: util-logopenfile.h:129
LogFileType
LogFileType
Definition: util-logopenfile.h:40
LogFileCtx_::flags
uint8_t flags
Definition: util-logopenfile.h:110
LogFileCtx_::Close
void(* Close)(struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:69
LogFileCtx_::fp
FILE * fp
Definition: util-logopenfile.h:54
SCMutex
#define SCMutex
Definition: threads-debug.h:114
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:517
LogFileCtx_::filemode
uint32_t filemode
Definition: util-logopenfile.h:82