5096 Commits (4922cd2d3699a2dcb472adee7569894105f14083)

 

All Branches   

Search

Author	SHA1	Message	Date
Tom DeCanio	730ee3d721	First cut at "united" file log output in JSON	11 years ago
Tom DeCanio	88a04742c0	JSON output cleanup	11 years ago
Tom DeCanio	b4ac0d90a4	remove unused http JSON code	11 years ago
Tom DeCanio	a12fa7c4e1	more output JSON cleanup	11 years ago
Tom DeCanio	6974817f72	remove dead JSON DNS output code	11 years ago
Tom DeCanio	a44b2b987b	JSON output cleanup	11 years ago
Tom DeCanio	3241732e27	rename alert-json.[ch] output-json.[ch]	11 years ago
Tom DeCanio	3bc95c9258	fix compile errors w/o libjansson	11 years ago
Tom DeCanio	8adbc741ba	remove unused JSON TMM_*JSON enumerations	11 years ago
Tom DeCanio	07d3b38d3b	Add support for JSON output to syslog/unix_stream/unix_dgram	11 years ago
Tom DeCanio	1dd6d7a104	Add "united" log to suricata.yaml.in	11 years ago
Tom DeCanio	6c1de2115c	JSON output cleanup	11 years ago
Tom DeCanio	c654b63f6a	add united TLS JSON logging	11 years ago
Tom DeCanio	51b7cf1491	add ICMP type and code support to JSON log	11 years ago
Tom DeCanio	c8beb9bf9d	Support for configuration of JSON http output module	11 years ago
Tom DeCanio	8c95b085c5	Add vlan and pcap_cnt to JSON logs	11 years ago
Tom DeCanio	ce6b07b1b9	First cut at united .yaml configuration	11 years ago
Tom DeCanio	11f84d4ff7	beginning of JSON config alignment	11 years ago
Tom DeCanio	280e4bcb61	move some JSON alert work outside of lock	11 years ago
Tom DeCanio	34d04c3104	JSON cleanup	11 years ago
Tom DeCanio	0df6af3a0b	Alert/HTTP/DNS JSON output working with Logstash	11 years ago
Tom DeCanio	5543b6eef4	nested json alert output	11 years ago
Tom DeCanio	b94b8e03bd	cleanup fallout from upstream merge with alert json work	11 years ago
Tom DeCanio	07571367d3	Change JSON alert syslog level to INFO	11 years ago
Tom DeCanio	860523f5bc	fix NULL string into JSON in alert-json	11 years ago
Tom DeCanio	e9b192fcc0	change srcport->sp dstport->dp	11 years ago
Tom DeCanio	5498654114	Add JSON formatted alert output	11 years ago
Victor Julien	7450f32351	stream: add performance output for stream pools ... Add info messages at shutdown that give an indication of pool use for the various segment and chunk pools.	11 years ago
Victor Julien	84696ebe2a	stream: configurable stream chunk prealloc ... The stream chunk pool contains preallocating stream chunks (StreamMsg). These are used for raw reassembly, used in raw content inspection by the detection engine. The default setting so far has been 250, which was hardcoded. This meant that in setups that needed more, allocs and frees would be happen constantly. This patch introduces a yaml option to set the 'prealloc' value in the pool. The default is still 250. stream.reassembly.chunk-prealloc Related to feature #1093.	11 years ago
Victor Julien	fe1c4951f9	stream: silence stream.reassembly.raw message	11 years ago
Victor Julien	b5f8f386a3	stream: configurable segment pools ... The stream reassembly engine uses a set of pools in which preallocated segments are stored. There are various pools each with different packet sizes. The goal is to lower memory presure. Until now, these pools were hardcoded. This patch introduces the ability to configure them fully from the yaml. There can be at max 256 of these pools. Yaml layout is as follows: stream: reassemble: segments: - size: 2048 prealloc: 3000 - size: 4 prealloc: 1000 - size: 1024 prealloc: 2000 The size is the packet size. The prealloc value indicates how many segments are set up at startup. The pools have no limit wrt how many segments can be used of a certain size. If the engine needs more than the prealloc size, segments are malloc'd and free'd. The only limit here is the stream.reassemble.memcap. If the yaml part if omitted, the default values are the same as before. Feature #1093	11 years ago
Victor Julien	b27d03e2f9	log-filestore: convert to FiledataLog API ... This patch converts the log-filestore module to use the new FiledataLog API.	11 years ago
Victor Julien	9ff6608668	Introduce Filedata Logger API ... A new logger API for registering file storage handlers. Where the FileLog handler is called once per file, this handler will be called for each data chunk so that storing the entire file is possible. The logger call in the API is as follows: typedef int (*FiledataLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, const FileData *, uint8_t flags); All data is const, thus should be read only. The final flags field is used to indicate to the caller that the file is new, or if it's being closed. Files use an internal unique id 'file_id' which can be used by the loggers to create unique file names. This id can use the 'waldo' feature of the log-filestore module. This patch moves that waldo loading and storing logic to this API's implementation. A new configuration directive 'file-store-waldo: <filename>' is added, but the existing waldo settings will also continue to work.	11 years ago
Victor Julien	b31e0abffe	log-filestore: cleanups ... Remove unused code. Make functions static. Move registration to the bottom.	11 years ago
Victor Julien	3e33ab4f83	log-filestore: tag truncated files as such ... Tag truncated files as truncated in the same way log-file does.	11 years ago
Victor Julien	38249398a3	tx-logger: speed up ... By bailing out early in case no logger is enabled for the protocol, a significant speed up is reached.	11 years ago
Victor Julien	078ff0c0cc	app-layer: add logger check to API ... The new API call: int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto) Returns TRUE if a logger is registered on the ip/alproto pair, and FALSE otherwise.	11 years ago
Victor Julien	4c024f9658	profiling: add logger api labels	11 years ago
Victor Julien	0e8ad126d7	log-file: convert to file-logger API ... Use file logger API. Also, check if the protocol is HTTP before getting the HTTP fields.	11 years ago
Victor Julien	ee2a8a9cda	Introduce 'file' logging API ... This patch introduces a new logging API for logging extracted file info. It allows for registration of a callback that is called once per file: when it's considered 'closed'. Users of this API register their Log Function through: OutputRegisterFileModule() The API uses a magic settings globally. This might be changed later.	11 years ago
Victor Julien	cef2eb01c5	log-file: cleanups ... Make all functions static. Move registration to the bottom.	11 years ago
Victor Julien	fb5b6dd019	prelude: convert to packet logger API ... Convert prelude logger to use the packet logger API.	11 years ago
Victor Julien	8623b8f941	prelude: fix configure and cleanup ... Fixes configure enabling of prelude. CFLAGS is reset, so the previous adding of -DPRELUDE was nixed. Using AC_DEFINE now. Cleanups: - make functions static - simplify handling of no prelude support - move registration to the bottom	11 years ago
Victor Julien	b0a9d08267	alert-syslog: convert to packet logger API ... Convert Syslog alert logger to packet logger API.	11 years ago
Victor Julien	ec20f45916	alert-syslog: cleanup ... Remove separate ipv4 and ipv6 registration functions. Make all functions static. Move registration function to the bottom. Simplify OS_WIN32 wrappers usage.	11 years ago
Victor Julien	6c36824d69	alert-pcapinfo: convert to packet logger API ... Convert pcap-info to use the packet logger API.	11 years ago
Victor Julien	a536e73695	alert-pcapinfo: clean up ... Make functions static. Move registration to the bottom.	11 years ago
Victor Julien	73377048fd	alert-debuglog: minor cleanups ... Clean up log functions after packet logger conversion. No more PacketQueue arguments.	11 years ago
Victor Julien	cd4796f3ca	alert-debuglog: port to packet logger api ... Convert AlertDebugLog to Packet logger API. Convert packet args to const.	11 years ago
Victor Julien	4b57d0272c	alert-debug log cleanups ... Make all funcs but registration static. Remove stale registation prototypes. Move registation func to the bottom.	11 years ago