|
|
|
|
@ -49,7 +49,7 @@ typedef uint32_t ThreadId;
|
|
|
|
|
* - Init: called once for each EVE instance using this filetype
|
|
|
|
|
* - ThreadInit: called once for each output thread
|
|
|
|
|
* - Write: called for each log record
|
|
|
|
|
* - ThreadInit: called once for each output thread on exit
|
|
|
|
|
* - ThreadDeinit: called once for each output thread on exit
|
|
|
|
|
* - Deinit: called once for each EVE instance using this filetype on exit
|
|
|
|
|
*
|
|
|
|
|
* Examples:
|
|
|
|
|
@ -114,7 +114,7 @@ typedef struct SCEveFileType_ {
|
|
|
|
|
*
|
|
|
|
|
* \param thread_id A unique ID to differentiate this thread from
|
|
|
|
|
* others. If EVE is not in threaded mode this will be called
|
|
|
|
|
* one with a ThreadId of 0. In threaded mode the ThreadId of
|
|
|
|
|
* once with a ThreadId of 0. In threaded mode the ThreadId of
|
|
|
|
|
* 0 correlates to the main Suricata thread.
|
|
|
|
|
*
|
|
|
|
|
* \param thread_data Output pointer for any data required by this
|
|
|
|
|
@ -179,7 +179,7 @@ SCEveFileType *SCEveFindFileType(const char *name);
|
|
|
|
|
* The function type for callbacks registered with
|
|
|
|
|
* SCEveRegisterCallback. This function will be called with the
|
|
|
|
|
* SCJsonBuilder just prior to the top-level object being closed. New
|
|
|
|
|
* fields maybe added, however there is no way to alter existing
|
|
|
|
|
* fields may be added, however, there is no way to alter existing
|
|
|
|
|
* objects already added to the SCJsonBuilder.
|
|
|
|
|
*
|
|
|
|
|
* \param tv The ThreadVars for the thread performing the logging.
|
|
|
|
|
@ -196,9 +196,9 @@ typedef void (*SCEveUserCallbackFn)(
|
|
|
|
|
* is called just before the root object on the SCJsonBuilder is to be
|
|
|
|
|
* closed.
|
|
|
|
|
*
|
|
|
|
|
* New objects and fields can be append, but exist entries cannot be modified.
|
|
|
|
|
* New objects and fields can be appended, but existing entries cannot be modified.
|
|
|
|
|
*
|
|
|
|
|
* Packet and Flow will be provided if available, but will other be
|
|
|
|
|
* Packet and Flow will be provided if available, but will otherwise be
|
|
|
|
|
* NULL.
|
|
|
|
|
*
|
|
|
|
|
* Limitations: At this time the callbacks will only be called for EVE
|
|
|
|
|
|