14 Commits (113d6a395020396d9d29e0ff7cb796caa85f9bc9)

Author	SHA1	Message	Date
Eric Leblond	113d6a3950	output-json: add create header with tx function ... To be able to correlate between events, it is better to have the tx_id information in the root object. This function adds a new function to automate the addition of the field.	10 years ago
Eric Leblond	636e3d93c0	log file: add type flag ... It will be used to store if the file is syslog or a real file.	11 years ago
Victor Julien	f1185d051c	flow id: quick and dirty first stab at a flow id ... Add a 'flow_id' that is the same for all records produced for packets belonging to the same flow. This patch simply takes the flow's memory address.	11 years ago
Victor Julien	eaf01449e3	json: add tcp flags to json utility function ... Turns a flags bitfield into a set of json bools.	11 years ago
Ken Steele	497575d38e	Add option on Tile-Gx for logging for fast.log alerts over PCIe ... When running on a TILEncore-Gx PCIe card, setting the filetype of fast.log to pcie, will open a connection over PCIe to a host application caleld tile-pcie-logd, that receives the alert strings and writes them to a file on the host. The file name to open is also passed over the PCIe link. This allows running Suricata on the TILEncore-Gx PCIe card, but have the alerts logged to the host system's file system efficiently. The PCIe API that is used is the Tilera Packet Queue (PQ) API which can access PCIe from User Space, thus avoiding system calls. Created util-logopenfile-tile.c and util-logopen-tile.h for the TILE specific PCIe logging functionality. Using Write() and Close() function pointers in LogFileCtx, which default to standard write and close for files and sockets, but are changed to PCIe write and close functions when a PCIe channel is openned for logging. Moved Logging contex out of tm-modules.h into util-logopenfile.h, where it makes more sense. This required including util-logopenfile.h into a couple of alert-*.c files, which previously were getting the definitions from tm-modules.h. The source and Makefile for tile-pcie-logd are added in contrib/tile-pcie-logd. By default, the file name for fast.log specified in suricata.yaml is used as the filename on the host. An optional argument to tile-pcie-logd, --prefix=, can be added to prepend the supplied file path. For example, is the file in suricata.yaml is specified as "/var/log/fast.log" and --prefix="/tmp", then the file will be written to "/tmp/var/log/fast.log". Check for TILERA_ROOT environment variable before building tile_pcie_logd Building tile_pcie_logd on x86 requires the Tilera MDE for its PCIe libraries and API header files. Configure now checs for TILERA_ROOT before enabling builing tile_pcie_logd in contrib/tile_pcie_logd	12 years ago
Eric Leblond	6fd9b4b255	json: add event_type key ... This patch adds an event_type key to the generated events. Current value is one of "dns", "alert, "file", "tls", "http", "drop". It is then easy to differentiate in log analysis tools the events based on source inside Suricata.	12 years ago
Victor Julien	cd7a5ff0ca	output: cleanups ... Preparation of making output type for json logs configurable.	12 years ago
Victor Julien	b5ef269b03	json outputs: cleanups ... Clean up header files and improve memory handling.	12 years ago
Victor Julien	bc71a43e08	http-json: separate module using tx api ... Turn HTTP json logger into a Tx Logger API logger.	12 years ago
Tom DeCanio	a3d86594dc	address most initial JSON pull request comments	12 years ago
Tom DeCanio	55df2d5cdb	add "united" drop JSON log	12 years ago
Tom DeCanio	730ee3d721	First cut at "united" file log output in JSON	12 years ago
Tom DeCanio	88a04742c0	JSON output cleanup	12 years ago
Tom DeCanio	3241732e27	rename alert-json.[ch] output-json.[ch]	12 years ago