From 39e8cbdf30d708c79351f7242b2612fb1eb0d404 Mon Sep 17 00:00:00 2001
From: Gurvinder Singh <gurvindersinghdahiya@gmail.com>
Date: Sun, 12 Dec 2010 16:16:27 +0100
Subject: [PATCH] added support for appending the log files

---
 src/alert-debuglog.c |   20 +++++++++++++++-----
 src/alert-fastlog.c  |   18 ++++++++++++++----
 src/log-httplog.c    |   16 ++++++++++++----
 src/output.h         |    2 ++
 suricata.yaml        |    3 +++
 5 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/src/alert-debuglog.c b/src/alert-debuglog.c
index 76db5d9..df3865f 100644
--- a/src/alert-debuglog.c
+++ b/src/alert-debuglog.c
@@ -60,7 +60,7 @@ TmEcode AlertDebugLogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQ
 TmEcode AlertDebugLogThreadInit(ThreadVars *, void*, void **);
 TmEcode AlertDebugLogThreadDeinit(ThreadVars *, void *);
 void AlertDebugLogExitPrintStats(ThreadVars *, void *);
-int AlertDebugLogOpenFileCtx(LogFileCtx* , const char *);
+int AlertDebugLogOpenFileCtx(LogFileCtx* , const char *, const char *);
 
 void TmModuleAlertDebugLogRegister (void) {
     tmm_modules[TMM_ALERTDEBUGLOG].name = MODULE_NAME;
@@ -442,8 +442,12 @@ OutputCtx *AlertDebugLogInitCtx(ConfNode *conf)
     if (filename == NULL)
         filename = DEFAULT_LOG_FILENAME;
 
+    const char *mode = ConfNodeLookupChildValue(conf, "append");
+    if (mode == NULL)
+        mode = DEFAULT_LOG_MODE_APPEND;
+    
     /** fill the new LogFileCtx with the specific AlertDebugLog configuration */
-    ret=AlertDebugLogOpenFileCtx(file_ctx, filename);
+    ret=AlertDebugLogOpenFileCtx(file_ctx, filename, mode);
 
     if(ret < 0)
         return NULL;
@@ -461,15 +465,21 @@ OutputCtx *AlertDebugLogInitCtx(ConfNode *conf)
  *  \param filename name of log file
  *  \return -1 if failure, 0 if succesful
  * */
-int AlertDebugLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename)
+int AlertDebugLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename, const
+                                char *mode)
 {
     int ret=0;
 
     char log_path[PATH_MAX], *log_dir;
     if (ConfGet("default-log-dir", &log_dir) != 1)
         log_dir = DEFAULT_LOG_DIR;
-    snprintf(log_path, PATH_MAX, "%s/%s", log_dir, DEFAULT_LOG_FILENAME);
-    file_ctx->fp = fopen(log_path, "w");
+    snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename);
+    if (strncmp(mode, "yes", sizeof(mode)) == 0) {
+        file_ctx->fp = fopen(log_path, "a");
+    } else {
+        file_ctx->fp = fopen(log_path, "w");
+    }
+
     if (file_ctx->fp == NULL) {
         SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path,
             strerror(errno));
diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c
index 1131a3f..09b0b08 100644
--- a/src/alert-fastlog.c
+++ b/src/alert-fastlog.c
@@ -70,7 +70,7 @@ TmEcode AlertFastLogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQu
 TmEcode AlertFastLogThreadInit(ThreadVars *, void *, void **);
 TmEcode AlertFastLogThreadDeinit(ThreadVars *, void *);
 void AlertFastLogExitPrintStats(ThreadVars *, void *);
-static int AlertFastLogOpenFileCtx(LogFileCtx *, const char *);
+static int AlertFastLogOpenFileCtx(LogFileCtx *, const char *, const char *);
 void AlertFastLogRegisterTests(void);
 static void AlertFastLogDeInitCtx(OutputCtx *);
 
@@ -320,7 +320,12 @@ OutputCtx *AlertFastLogInitCtx(ConfNode *conf)
     const char *filename = ConfNodeLookupChildValue(conf, "filename");
     if (filename == NULL)
         filename = DEFAULT_LOG_FILENAME;
-    if (AlertFastLogOpenFileCtx(logfile_ctx, filename) < 0) {
+
+    const char *mode = ConfNodeLookupChildValue(conf, "append");
+    if (mode == NULL)
+        mode = DEFAULT_LOG_MODE_APPEND;
+    
+    if (AlertFastLogOpenFileCtx(logfile_ctx, filename, mode) < 0) {
         LogFileFreeCtx(logfile_ctx);
         return NULL;
     }
@@ -348,14 +353,19 @@ static void AlertFastLogDeInitCtx(OutputCtx *output_ctx)
  *  \param filename name of log file
  *  \return -1 if failure, 0 if succesful
  * */
-static int AlertFastLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename)
+static int AlertFastLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename,
+                                    const char *mode)
 {
     char log_path[PATH_MAX], *log_dir;
     if (ConfGet("default-log-dir", &log_dir) != 1)
         log_dir = DEFAULT_LOG_DIR;
     snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename);
 
-    file_ctx->fp = fopen(log_path, "w");
+    if (strncmp(mode, "yes", sizeof(mode)) == 0) {
+        file_ctx->fp = fopen(log_path, "a");
+    } else {
+        file_ctx->fp = fopen(log_path, "w");
+    }
 
     if (file_ctx->fp == NULL) {
         SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path,
diff --git a/src/log-httplog.c b/src/log-httplog.c
index 1aba336..b65fd62 100644
--- a/src/log-httplog.c
+++ b/src/log-httplog.c
@@ -56,7 +56,7 @@ TmEcode LogHttpLogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueu
 TmEcode LogHttpLogThreadInit(ThreadVars *, void *, void **);
 TmEcode LogHttpLogThreadDeinit(ThreadVars *, void *);
 void LogHttpLogExitPrintStats(ThreadVars *, void *);
-int LogHttpLogOpenFileCtx(LogFileCtx* , const char *);
+int LogHttpLogOpenFileCtx(LogFileCtx* , const char *, const char *);
 static void LogHttpLogDeInitCtx(OutputCtx *);
 
 void TmModuleLogHttpLogRegister (void) {
@@ -426,8 +426,11 @@ OutputCtx *LogHttpLogInitCtx(ConfNode *conf)
     if (filename == NULL)
         filename = DEFAULT_LOG_FILENAME;
 
+    const char *mode = ConfNodeLookupChildValue(conf, "append");
+    if (mode == NULL)
+        mode = DEFAULT_LOG_MODE_APPEND;
     /** fill the new LogFileCtx with the specific LogHttpLog configuration */
-    ret=LogHttpLogOpenFileCtx(file_ctx, filename);
+    ret=LogHttpLogOpenFileCtx(file_ctx, filename, mode);
 
     if(ret < 0)
         return NULL;
@@ -453,14 +456,19 @@ static void LogHttpLogDeInitCtx(OutputCtx *output_ctx)
  *  \param config_file for loading separate configs
  *  \return -1 if failure, 0 if succesful
  * */
-int LogHttpLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename)
+int LogHttpLogOpenFileCtx(LogFileCtx *file_ctx, const char *filename, const
+                            char *mode)
 {
     char log_path[PATH_MAX], *log_dir;
     if (ConfGet("default-log-dir", &log_dir) != 1)
         log_dir = DEFAULT_LOG_DIR;
     snprintf(log_path, PATH_MAX, "%s/%s", log_dir, filename);
 
-    file_ctx->fp = fopen(log_path, "w");
+    if (strncmp(mode, "yes", sizeof(mode)) == 0) {
+        file_ctx->fp = fopen(log_path, "a");
+    } else {
+        file_ctx->fp = fopen(log_path, "w");
+    }
 
     if (file_ctx->fp == NULL) {
         SCLogError(SC_ERR_FOPEN, "ERROR: failed to open %s: %s", log_path,
diff --git a/src/output.h b/src/output.h
index 139a8ca..2315705 100644
--- a/src/output.h
+++ b/src/output.h
@@ -26,6 +26,8 @@
 
 #include "suricata.h"
 
+#define DEFAULT_LOG_MODE_APPEND     "yes"
+
 typedef struct OutputModule_ {
     char *name;
     char *conf_name;
diff --git a/suricata.yaml b/suricata.yaml
index 71d02e3..15631f7 100644
--- a/suricata.yaml
+++ b/suricata.yaml
@@ -36,6 +36,7 @@ outputs:
   - fast:
       enabled: yes
       filename: fast.log
+      append: yes
 
   # log output for use with Barnyard
   - unified-log:
@@ -65,12 +66,14 @@ outputs:
   - http-log:
       enabled: yes
       filename: http.log
+      append: yes
 
   # a full alerts log containing much information for signature writers
   # or for investigating suspected false positives.
   - alert-debug:
       enabled: no
       filename: alert-debug.log
+      append: yes
 
   # alert output to prelude (http://www.prelude-technologies.com/) only
   # available if Suricata has been compiled with --enable-prelude
-- 
1.7.1

