From 39e8cbdf30d708c79351f7242b2612fb1eb0d404 Mon Sep 17 00:00:00 2001 From: Gurvinder Singh Date: Sun, 12 Dec 2010 16:16:27 +0100 Subject: [PATCH] added support for appending the log files --- src/alert-debuglog.c | 20 +++++++++++++++----- src/alert-fastlog.c | 18 ++++++++++++++---- src/log-httplog.c | 16 ++++++++++++---- src/output.h | 2 ++ suricata.yaml | 3 +++ 5 files changed, 46 insertions(+), 13 deletions(-) diff --git a/src/alert-debuglog.c b/src/alert-debuglog.c index 76db5d9..df3865f 100644 --- a/src/alert-debuglog.c +++ b/src/alert-debuglog.c @@ -60,7 +60,7 @@ TmEcode AlertDebugLogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQ TmEcode AlertDebugLogThreadInit(ThreadVars *, void*, void **); TmEcode AlertDebugLogThreadDeinit(ThreadVars *, void *); void AlertDebugLogExitPrintStats(ThreadVars *, void *); -int AlertDebugLogOpenFileCtx(LogFileCtx* , const char *); +int AlertDebugLogOpenFileCtx(LogFileCtx* , const char *, const char *); void TmModuleAlertDebugLogRegister (void) { tmm_modules[TMM_ALERTDEBUGLOG].name = MODULE_NAME; @@ -442,8 +442,12 @@ OutputCtx *AlertDebugLogInitCtx(ConfNode *conf) if (filename == NULL) filename = DEFAULT_LOG_FILENAME; + const char *mode = ConfNodeLookupChildValue(conf, "append"); + if (mode == NULL) + mode = DEFAULT_LOG_MODE_APPEND; + /** fill the new LogFileCtx with the specific AlertDebugLog configuration */ - ret=AlertDebugLogOpenFileCtx(file_ctx, filename); + ret=AlertDebugLogOpenFileCtx(file_ctx, filename, mode); if(ret < 0) return NULL; @@ -461,15 +465,21 @@ OutputCtx *AlertDebugLogInitCtx(ConfNode *conf) * \param filename name of log file * \return -1 if failure, 0 if succesful * */ -int AlertDebugLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename) +int AlertDebugLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename, const + char *mode) { int ret=0; char log_path[PATH_MAX], *log_dir; if (ConfGet("default-log-dir", &log_dir) != 1) log_dir = DEFAULT_LOG_DIR; - snprintf(log_path, PATH_MAX, "%s/%s", log_dir, DEFAULT_LOG_FILENAME); - file_ctx->fp = fopen(log_path, "w"); + snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename); + if (strncmp(mode, "yes", sizeof(mode)) == 0) { + file_ctx->fp = fopen(log_path, "a"); + } else { + file_ctx->fp = fopen(log_path, "w"); + } + if (file_ctx->fp == NULL) { SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path, strerror(errno)); diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c index 1131a3f..09b0b08 100644 --- a/src/alert-fastlog.c +++ b/src/alert-fastlog.c @@ -70,7 +70,7 @@ TmEcode AlertFastLogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQu TmEcode AlertFastLogThreadInit(ThreadVars *, void *, void **); TmEcode AlertFastLogThreadDeinit(ThreadVars *, void *); void AlertFastLogExitPrintStats(ThreadVars *, void *); -static int AlertFastLogOpenFileCtx(LogFileCtx *, const char *); +static int AlertFastLogOpenFileCtx(LogFileCtx *, const char *, const char *); void AlertFastLogRegisterTests(void); static void AlertFastLogDeInitCtx(OutputCtx *); @@ -320,7 +320,12 @@ OutputCtx *AlertFastLogInitCtx(ConfNode *conf) const char *filename = ConfNodeLookupChildValue(conf, "filename"); if (filename == NULL) filename = DEFAULT_LOG_FILENAME; - if (AlertFastLogOpenFileCtx(logfile_ctx, filename) < 0) { + + const char *mode = ConfNodeLookupChildValue(conf, "append"); + if (mode == NULL) + mode = DEFAULT_LOG_MODE_APPEND; + + if (AlertFastLogOpenFileCtx(logfile_ctx, filename, mode) < 0) { LogFileFreeCtx(logfile_ctx); return NULL; } @@ -348,14 +353,19 @@ static void AlertFastLogDeInitCtx(OutputCtx *output_ctx) * \param filename name of log file * \return -1 if failure, 0 if succesful * */ -static int AlertFastLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename) +static int AlertFastLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename, + const char *mode) { char log_path[PATH_MAX], *log_dir; if (ConfGet("default-log-dir", &log_dir) != 1) log_dir = DEFAULT_LOG_DIR; snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename); - file_ctx->fp = fopen(log_path, "w"); + if (strncmp(mode, "yes", sizeof(mode)) == 0) { + file_ctx->fp = fopen(log_path, "a"); + } else { + file_ctx->fp = fopen(log_path, "w"); + } if (file_ctx->fp == NULL) { SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path, diff --git a/src/log-httplog.c b/src/log-httplog.c index 1aba336..b65fd62 100644 --- a/src/log-httplog.c +++ b/src/log-httplog.c @@ -56,7 +56,7 @@ TmEcode LogHttpLogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueu TmEcode LogHttpLogThreadInit(ThreadVars *, void *, void **); TmEcode LogHttpLogThreadDeinit(ThreadVars *, void *); void LogHttpLogExitPrintStats(ThreadVars *, void *); -int LogHttpLogOpenFileCtx(LogFileCtx* , const char *); +int LogHttpLogOpenFileCtx(LogFileCtx* , const char *, const char *); static void LogHttpLogDeInitCtx(OutputCtx *); void TmModuleLogHttpLogRegister (void) { @@ -426,8 +426,11 @@ OutputCtx *LogHttpLogInitCtx(ConfNode *conf) if (filename == NULL) filename = DEFAULT_LOG_FILENAME; + const char *mode = ConfNodeLookupChildValue(conf, "append"); + if (mode == NULL) + mode = DEFAULT_LOG_MODE_APPEND; /** fill the new LogFileCtx with the specific LogHttpLog configuration */ - ret=LogHttpLogOpenFileCtx(file_ctx, filename); + ret=LogHttpLogOpenFileCtx(file_ctx, filename, mode); if(ret < 0) return NULL; @@ -453,14 +456,19 @@ static void LogHttpLogDeInitCtx(OutputCtx *output_ctx) * \param config_file for loading separate configs * \return -1 if failure, 0 if succesful * */ -int LogHttpLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename) +int LogHttpLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename, const + char *mode) { char log_path[PATH_MAX], *log_dir; if (ConfGet("default-log-dir", &log_dir) != 1) log_dir = DEFAULT_LOG_DIR; snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename); - file_ctx->fp = fopen(log_path, "w"); + if (strncmp(mode, "yes", sizeof(mode)) == 0) { + file_ctx->fp = fopen(log_path, "a"); + } else { + file_ctx->fp = fopen(log_path, "w"); + } if (file_ctx->fp == NULL) { SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path, diff --git a/src/output.h b/src/output.h index 139a8ca..2315705 100644 --- a/src/output.h +++ b/src/output.h @@ -26,6 +26,8 @@ #include "suricata.h" +#define DEFAULT_LOG_MODE_APPEND "yes" + typedef struct OutputModule_ { char *name; char *conf_name; diff --git a/suricata.yaml b/suricata.yaml index 71d02e3..15631f7 100644 --- a/suricata.yaml +++ b/suricata.yaml @@ -36,6 +36,7 @@ outputs: - fast: enabled: yes filename: fast.log + append: yes # log output for use with Barnyard - unified-log: @@ -65,12 +66,14 @@ outputs: - http-log: enabled: yes filename: http.log + append: yes # a full alerts log containing much information for signature writers # or for investigating suspected false positives. - alert-debug: enabled: no filename: alert-debug.log + append: yes # alert output to prelude (http://www.prelude-technologies.com/) only # available if Suricata has been compiled with --enable-prelude -- 1.7.1