Commit message (Collapse)AuthorAgeFilesLines
* util: fix warning on format stringEric Leblond2014-01-251-20/+21
| | | | | | | pp_print macro was not correctly formatting u64. This patch renames it to pp_print_u as it is only used to print integer. It also use the PRIu* macros to have a correct format string for all integers type.
* nacct: fix format warningEric Leblond2014-01-252-2/+3
| | | | | | Some counter have been recently switch to u64. This has caused warnings relative to format string. This patch uses PRIu64 macro to fix these warnings.
* ulogd: use AC_SEARCH_LIBS for libpthreadGustavo Zacarias2013-12-112-3/+4
| | | | | | | | | Some uClibc-based toolchains lack threading support, so use AC_SEARCH_LIB instead of AC_CHECK_LIB to check for libpthread availability and link conditionally if found since it's only used for the database backends. Signed-off-by: Gustavo Zacarias <>
* Set release number to 2.0.3.ulogd-2.0.3Eric Leblond2013-11-191-1/+1
| | | | Signed-off-by: Eric Leblond <>
* ulogd: ulogd_inppkt_NFLOG: close nflog handle after unbindingChris Boot2013-11-181-1/+1
| | | | | | | | The nflog handle is closed, and then nflog_unbind_pf() is called on it, which triggers an assertion failure within libnfnetlink. This patch simply moves the nflog_close() just after the nflog_unbind_pf() calls. Signed-off-by: Chris Boot <>
* nfct: make NFCT packet counter/length 64 bitUlrich Weber2013-10-103-28/+28
| | | | | | | | | | | | | | Kernel and libnetfilter_conntrack counters are 64bit, so use 64bit too in ulogd instead of 32bit. Worked fine on little endian systems but big endian systems had zero counter... Didn't test ipfix output, but RFC allows template with either 32 or 64 counters, so should be safe. Signed-off-by: Ulrich Weber <> Signed-off-by: Eric Leblond <>
* ulogd: use daemon() functionEric Leblond2013-10-101-17/+13
| | | | | | | | This patches update the daemonization code. It is done earlier and it uses the daemon(à function which is used for daemonization by most projects. Signed-off-by: Eric Leblond <>
* ulogd.conf: add missing quote.Eric Leblond2013-10-101-1/+1
| | | | | | | | Pcap file variable was not quoted. This was confusing as the correct file was not open if the user did uncomment the variable. Signed-off-by: Eric Leblond <>
* pgsql: add var to specify arbitrary conn paramsEric Leblond2013-06-082-40/+53
| | | | | | | | | This patch adds a configuration variable for PostgreSQL output. Named connstring it stores the character string that will be used to connect to the PostgreSQL server. This allows the user to use all options available like TLS parameters for example. Signed-off-by: Eric Leblond <>
* Improve pid file handling.Eric Leblond2013-05-211-12/+54
| | | | | | | | | | This patch improves latest patch by splitting in two part the pid file creation. This allows to display a message to stdout when ulogd can not be started. Another linked improvement is that the plugin initialization is not done if the pid file existence will result in a ulogd exit. Signed-off-by: Eric Leblond <>
* ulogd: Implement PID file writingChris Boot2013-05-212-1/+149
| | | | | | | | The deamon currently does not have the ability to write a PID file to track its process ID. This is very useful to an init script and to ensure there is only one running instance. This patch implements this functionality. Signed-off-by: Chris Boot <>
* ulogd: Perform nice() before giving up rootChris Boot2013-05-211-7/+7
| | | | | | | | The daemon code currently tries to nice(-1) just after having given up root privileges, which fails. This patch moves the nice(-1) call to just before the code that gives up the required privileges. Signed-off-by: Chris Boot <>
* Exec libmnl config check only if nfacct is enabledVictor Julien2013-05-211-1/+1
| | | | | | In case nfacct is not enabled in ulogd2, libmnl is not used. So it shouldn't be a hard global dependency, but instead only a dependency in case nfacct is enabled.
* db: db ring has precedence over backlog.Eric Leblond2013-05-211-5/+7
* db: disable SIGHUP if ring buffer is used.Eric Leblond2013-05-211-3/+8
| | | | | | | The handling of signal when using threads can be complicated. When ring buffer is used for query, this means ulogd will have to follow some sort of mutex. Thus, it is easier and better performance wise to disable the reload via SIGHUP when the ring buffer is used.
* db: add ring buffer for DB queryEric Leblond2013-05-215-14/+178
| | | | | | | | | | | This patch adds an optional ring buffer option which modify the way database queries are made. The main thread is only handling kernel message reading and query formatting. The SQL request is made in a separate dedicated thread. The idea is to try to avoid buffer overrun by minimizing the time requested to treat kernel message. Doing synchronous SQL request, as it was made before was causing a delay which could cause some messages to be lost in case of burst from kernel side.
* db: use offset instead of direct pointer.Eric Leblond2013-05-212-8/+10
| | | | | Use an offset approach to get the start of values printing area. It is more generic and will be use soon.
* db: suppress field in db structureEric Leblond2013-05-212-19/+19
| | | | | The field is currently only used in a single function as a string pointer and can thus be removed from the db instance structure.
* db: store data in memory during database downtimeEric Leblond2013-05-213-33/+180
| | | | | | | This patch is adding a mechanism to store query in a backlog build in memory. This allow to store events during downtime in memory and realize the effective insertion when the database comes back. A memory cap is used to avoid any memory flooding.
* sqlite3: add sanity checkingEric Leblond2013-04-201-0/+2
| | | | Nullify sqlite3 handler at deinit.
* mysql: add sanity checkingEric Leblond2013-04-201-1/+3
| | | | Nullify mysql handler at deinit.
* postgresql: add sanity checkingEric Leblond2013-04-201-1/+3
| | | | Clean postgresql handler at deinit.
* Fix automagic support of dbi, pcap and sqlite3Ilya Tumaykin2013-04-201-10/+20
| | | | | | | | | | | | | | | | | | ulogd has automagic deps for several output plugins right now, namely dbi, pcap and sqlite3. These plugins are built if the appropriate libs are present on user's system. While this situation is fine with binary distros it is not OK on source-based ones such as Gentoo. The problem arises when such a program links against libs without user's request and libs are later removed from system which leaves program in a broken state. This patch is modifying which we apply in our package and which fixes mentioned issue. It adds 3 new configure options: -- without-{dbi,pcap.sqlite}. I would like to emphasize that this patch doesn't change default behaviour of configure script at all, so all other distros won't suffer. We simply add options to explicitly disable any attempts to try and detect libs for automagic deps, which is enough to avoid unnecessary linkage.
* ulogd: display stack during configurationEric Leblond2013-04-201-1/+1
* Revert "ulogd: close logfile description in the exit path of parent process"Pablo Neira Ayuso2013-03-271-1/+0
| | | | | | | This reverts commit 3179bd4de89de7c2388849f5bc48e8f5aad9e5b9. Pointing to the wrong place. This is not the file descriptor that ulogd is leaking.
* ulogd: close logfile description in the exit path of parent processPablo Neira Ayuso2013-03-261-0/+1
| | | | | | | | | | | | | | | Joan Touzet reported that file descriptor 3 was not ever closed in the exit path of the parent process: open("ulogd.conf", O_RDONLY) = 3 That corresponds to the the file descriptor that was used to parse the configuration file was not closed. This closes: Reported-by: Joan Touzet <> Signed-off-by: Pablo Neira Ayuso <>
* ulogd: change verbosity of a messageEric Leblond2013-03-201-1/+1
| | | | | The "registering plugin" message is not really useful as the message is really explicit if a plugin is missing.
* nfct: use timestamp of conntrack object.Eric Leblond2013-03-051-10/+32
| | | | | | | If conntrack object sent by connection tracking system is containing a timestamp we use it instead of a gettimeofday() based counter. Signed-off-by: Eric Leblond <>
* Prepare release number to 2.0.2ulogd-2.0.2Eric Leblond2013-02-252-125/+1
| | | | | Update release number and delete Changes file because we can use git changelog fot that.
* Update READMEEric Leblond2013-02-251-56/+63
| | | | Get rid of ULOG only documentation and adds some new stuffs.
* Update man page.Eric Leblond2013-02-251-7/+14
* logemu: return error if configuration is invalid.Eric Leblond2013-02-181-4/+1
* Add handling of too long line and arguments.Eric Leblond2013-02-183-1/+29
| | | | | When an argument or a line is too long, it can not be store into ulogd configuration and this must results in a error.
* Fix typo in comments.Eric Leblond2013-02-181-3/+3
* Use access to ensure readability of config gileEric Leblond2013-02-182-2/+11
| | | | | This patch adds a call to access to check the readability of the configuration file.
* Suppress dead FIXME.Eric Leblond2013-02-182-3/+0
* Update TODO.Eric Leblond2013-02-171-7/+0
| | | | Try to sync TODO with real state of the project.
* graphite: fix crash on i386Eric Leblond2013-02-171-2/+2
| | | | | | | | It seems a cast of time_t is needed for i386 system to avoid a crash. I've added a cast to uint64_t that should be ok on all Linux system. Reported-by:
* Fix make distcheckEric Leblond2013-01-251-1/+1
| | | | Recently introduced addr.h was missing from
* Add TAGS to .gitignoreEric Leblond2013-01-251-0/+1
* graphite: fix warning about gnu extension usageEric Leblond2013-01-181-4/+4
| | | | | clang is complaining about missing = being a gnu extension. This patch adds equal sign to fix the warning.
* base: fix warning on pointer handlingEric Leblond2013-01-181-4/+4
* Fix warning on formatEric Leblond2013-01-181-1/+1
| | | | | It seems Z is a libc5 only format modifier. Using standard 'z' instead.
* Get rid of SVN tag in comment.Eric Leblond2013-01-1831-70/+33
| | | | This patch also update some copyright and licence declaration.
* Add -l option to set log level from command lineEric Leblond2013-01-182-4/+15
| | | | | | This patch adds a '-l' option which can be used to setup ulogd loglevel. Command line option has precedence on the configuration file one.
* conf: add flag to allow option setup tuningEric Leblond2013-01-182-1/+6
| | | | | | This patch adds a flag to the config_entry structure to be able to tune setup. First usage is to ask config parser not to update a key if it has been already set.
* ulogd: add -v option to display message on stderr.Eric Leblond2013-01-061-8/+33
| | | | | If can be painful to have to check the logfile, so this patch adds a '-v' option which display logs message to stderr.
* addr: fix compilation warningEric Leblond2013-01-051-2/+2
| | | | | This patch fixes a compilation warning related to a signed and unsigned integer comparison.
* nfct: add protocol filterEric Leblond2013-01-052-2/+59
| | | | | | | This patch adds a new configuration variable which is used to limit conntrack event to connection of these protocols: For example: accept_proto_filter=tcp,sctp
* nfct: implement src and dst filterEric Leblond2013-01-052-2/+218
| | | | | | | This patch implements two filtering options in NFCT input plugin. If 'accept_src_filter' is set to a network it will only catch the event where the source is that specific network. 'accept_dst_filter' does the same for the destination.