|
|
|
@ -65,45 +65,11 @@
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJson (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);
|
|
|
|
|
TmEcode OutputJsonThreadInit(ThreadVars *, void *, void **);
|
|
|
|
|
TmEcode OutputJsonThreadDeinit(ThreadVars *, void *);
|
|
|
|
|
int OutputJsonOpenFileCtx(LogFileCtx *, char *);
|
|
|
|
|
void OutputJsonRegisterTests(void);
|
|
|
|
|
|
|
|
|
|
void TmModuleOutputJsonRegister (void)
|
|
|
|
|
{
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].name = "OutputJSON";
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].ThreadInit = OutputJsonThreadInit;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].Func = OutputJson;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].ThreadDeinit = OutputJsonThreadDeinit;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].RegisterTests = OutputJsonRegisterTests;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
OutputCtx *OutputJsonInitCtx(ConfNode *conf)
|
|
|
|
|
{
|
|
|
|
|
SCLogDebug("Can't init JSON output - JSON support was disabled during build.");
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJsonThreadInit(ThreadVars *t, void *initdata, void **data)
|
|
|
|
|
{
|
|
|
|
|
SCLogDebug("Can't init JSON output thread - JSON support was disabled during build.");
|
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJson (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
|
|
|
|
|
{
|
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJsonThreadDeinit(ThreadVars *t, void *data)
|
|
|
|
|
{
|
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void OutputJsonRegisterTests (void)
|
|
|
|
|
{
|
|
|
|
|
SCLogDebug("Can't register JSON output - JSON support was disabled during build.");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#else /* implied we do have JSON support */
|
|
|
|
@ -116,23 +82,10 @@ void OutputJsonRegisterTests (void)
|
|
|
|
|
|
|
|
|
|
#define OUTPUT_BUFFER_SIZE 65536
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJson (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);
|
|
|
|
|
TmEcode OutputJsonThreadInit(ThreadVars *, void *, void **);
|
|
|
|
|
TmEcode OutputJsonThreadDeinit(ThreadVars *, void *);
|
|
|
|
|
void OutputJsonExitPrintStats(ThreadVars *, void *);
|
|
|
|
|
void OutputJsonRegisterTests(void);
|
|
|
|
|
static void OutputJsonDeInitCtx(OutputCtx *);
|
|
|
|
|
|
|
|
|
|
void TmModuleOutputJsonRegister (void)
|
|
|
|
|
{
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].name = MODULE_NAME;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].ThreadInit = OutputJsonThreadInit;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].Func = OutputJson;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].ThreadExitPrintStats = OutputJsonExitPrintStats;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].ThreadDeinit = OutputJsonThreadDeinit;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].RegisterTests = OutputJsonRegisterTests;
|
|
|
|
|
tmm_modules[TMM_OUTPUTJSON].cap_flags = 0;
|
|
|
|
|
|
|
|
|
|
OutputRegisterModule(MODULE_NAME, "eve-log", OutputJsonInitCtx);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -372,51 +325,6 @@ int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJson (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
|
|
|
|
|
{
|
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJsonThreadInit(ThreadVars *t, void *initdata, void **data)
|
|
|
|
|
{
|
|
|
|
|
AlertJsonThread *aft = SCMalloc(sizeof(AlertJsonThread));
|
|
|
|
|
if (unlikely(aft == NULL))
|
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
|
memset(aft, 0, sizeof(AlertJsonThread));
|
|
|
|
|
|
|
|
|
|
if(initdata == NULL)
|
|
|
|
|
{
|
|
|
|
|
SCLogDebug("Error getting context for EveLog. \"initdata\" argument NULL");
|
|
|
|
|
SCFree(aft);
|
|
|
|
|
return TM_ECODE_FAILED;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
*data = (void *)aft;
|
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TmEcode OutputJsonThreadDeinit(ThreadVars *t, void *data)
|
|
|
|
|
{
|
|
|
|
|
AlertJsonThread *aft = (AlertJsonThread *)data;
|
|
|
|
|
if (aft == NULL) {
|
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SCFree(aft);
|
|
|
|
|
return TM_ECODE_OK;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void OutputJsonExitPrintStats(ThreadVars *tv, void *data)
|
|
|
|
|
{
|
|
|
|
|
AlertJsonThread *aft = (AlertJsonThread *)data;
|
|
|
|
|
if (aft == NULL) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
SCLogInfo("JSON output wrote %" PRIu64 " alerts", aft->file_ctx->alerts);
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \brief Create a new LogFileCtx for "fast" output style.
|
|
|
|
|
* \param conf The configuration node for this output.
|
|
|
|
@ -621,21 +529,4 @@ static void OutputJsonDeInitCtx(OutputCtx *output_ctx)
|
|
|
|
|
SCFree(output_ctx);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*------------------------------Unittests-------------------------------------*/
|
|
|
|
|
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
|
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \brief This function registers unit tests for AlertFastLog API.
|
|
|
|
|
*/
|
|
|
|
|
void OutputJsonRegisterTests(void)
|
|
|
|
|
{
|
|
|
|
|
|
|
|
|
|
#ifdef UNITTESTS
|
|
|
|
|
|
|
|
|
|
#endif /* UNITTESTS */
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|