log-pcap: one time errors on file open

If compression was not enabled, the open error was actually suppressed
by default by only being logged at info level, however with
compression it was logged as an error. As opening is retried as long
as it fails to open, make both log as error but wrap in a flag so the
error is logged once until success.
pull/9088/head
Jason Ish 3 years ago
parent bf589f0812
commit d2a5a55e0a

@ -179,6 +179,8 @@ typedef struct PcapLogData_ {
char *filename_parts[MAX_TOKS];
int filename_part_cnt;
struct timeval last_pcap_dump;
int fopen_err; /**< set to the last fopen error */
bool pcap_open_err; /**< true if the last pcap open errored */
PcapLogCompressionData compression;
} PcapLogData;
@ -422,8 +424,13 @@ static int PcapLogOpenHandles(PcapLogData *pl, const Packet *p)
if (pl->compression.format == PCAP_LOG_COMPRESSION_FORMAT_NONE) {
if ((pl->pcap_dumper = pcap_dump_open(pl->pcap_dead_handle,
pl->filename)) == NULL) {
SCLogInfo("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle));
if (!pl->pcap_open_err) {
SCLogError("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle));
pl->pcap_open_err = true;
}
return TM_ECODE_FAILED;
} else {
pl->pcap_open_err = false;
}
}
#ifdef HAVE_LIBLZ4
@ -432,16 +439,26 @@ static int PcapLogOpenHandles(PcapLogData *pl, const Packet *p)
comp->file = fopen(pl->filename, "w");
if (comp->file == NULL) {
SCLogError("Error opening file for compressed output: %s", strerror(errno));
if (errno != pl->fopen_err) {
SCLogError("Error opening file for compressed output: %s", strerror(errno));
pl->fopen_err = errno;
}
return TM_ECODE_FAILED;
} else {
pl->fopen_err = 0;
}
if ((pl->pcap_dumper = pcap_dump_fopen(pl->pcap_dead_handle, comp->pcap_buf_wrapper)) ==
NULL) {
SCLogError("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle));
if (!pl->pcap_open_err) {
SCLogError("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle));
pl->pcap_open_err = true;
}
fclose(comp->file);
comp->file = NULL;
return TM_ECODE_FAILED;
} else {
pl->pcap_open_err = false;
}
uint64_t bytes_written = LZ4F_compressBegin(comp->lz4f_context,

Loading…
Cancel
Save