Project

General

Profile

Feature #772

Feature #1007: united output

JSON output for alerts

Added by Aaron Nikula over 8 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

I think it would be beneficial for Suricata to have an optional JSON formatted log file for alerts.

Some background: Right now the popular frontends that work with Suricata are dependent on Unified2 and Barnyard2 to get data from Suricata into a database. With JSON, there is more log file overhead but then this data can be more easily managed/forwarded with tools like syslog-ng, and then imported to MySQL or a non-traditional database like MongoDB.


Subtasks

Feature #542: TLS JSON outputClosedTom DeCanio09/06/2012Actions
#1

Updated by Victor Julien over 8 years ago

From oisf-users:

FYI, take a look at yajl lib for JSON if your looking for a lib.
Seems pretty nice and very light. We are using it in ironbee now.

http://lloyd.github.com/yajl/

#2

Updated by Victor Julien over 8 years ago

We already use libjansson for the unix socket protocol, so using this
would require some refactoring. Do you think this yajl will bring big
benefits over libjansson?

Depends on what you use it for. Yajl allows for stream based parsing
directly into your own structures. No need to parse everything into a
tree of nodes and then read through that. So, I think yajl is more
efficiently using resources, but at the cost of some extra code
complexity sue to having to write callbacks for each node type. We
needed the streaming parser for potentially large json structures coming
in chunks. Yajl is nice, but I think libjannson is as well. They just
solve different needs. For instance you could build libjannson on top of
yajl.

The only performance critical use we have is generating JSON records,
not parsing them. The unix socket code that parses JSON records is async
and we expect low volume. Otherwise we will be using it to generate
output based on alerts, events. So on the output side it is critical
that it's fast.

If libjannson forces you to build a full in-memory json tree, then
traverse the tree again to write it out, then yajl may be more
performant as yajl can stream this to the output.

#3

Updated by Victor Julien over 8 years ago

  • Assignee set to Eric Leblond
#4

Updated by Victor Julien over 7 years ago

  • Target version set to TBD
#5

Updated by Victor Julien over 7 years ago

  • Status changed from New to Assigned
  • Assignee changed from Eric Leblond to Tom DeCanio
  • Target version changed from TBD to 2.0beta2
  • Parent task set to #1007
#6

Updated by Victor Julien over 7 years ago

  • Target version changed from 2.0beta2 to 2.0rc1
#7

Updated by Victor Julien over 7 years ago

  • Status changed from Assigned to Closed

Also available in: Atom PDF