| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
| |
Signed-off-by: Felix Janda <felix.janda@posteo.de>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds storage for CIM field name in ulogd key. This
will be used by JSON output to interoperate with logging
collector such as logstash or splunk.
Common Information Model is an open standard that defines how managed
elements in an IT environment are represented as a common set of objects
and relationships between them:
http://www.dmtf.org/standards/cim
This seems to be mainly XML based but there is a JSON version of some
aspects of the model. One of the main documentation on CIM in JSON
format seems to be:
http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference
Using the correct CIM field name allow events coming from ulogd to be
correlated with events coming from other sources.
|
|
|
|
|
|
| |
Some counter have been recently switch to u64. This has caused warnings
relative to format string. This patch uses PRIu64 macro to fix these
warnings.
|
|
|
|
| |
This patch also update some copyright and licence declaration.
|
| |
|
|
|
|
|
|
|
| |
It was wrong, use VERSION constant which uses the version
information available in configure.ac.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
| |
This new type will be used in flow-up patch to support XML output.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
| |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds reference counting for plugins. This is used to fix
a double stop for input plugins that are reused.
This problem was reported by Salih Gonullu <sag@open.ch>:
http://marc.info/?l=netfilter&m=129439584700693&w=2
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
|
| |
This reverts commit 0ff525cb0506b2c043bc9df6d7e7b486c865bc38. A stable
and clean API should be provided if we choose to offer for external
module capability.
|
|
|
|
|
| |
This patch modifies Makefile.am to install the headers needed for
compilation of plugins outside of the source tree.
|
|
|
|
|
| |
This patch adds config.h inclusion in ulogd.h to be able to use all
defined value in the whole project.
|
|
|
|
|
| |
Incorrect definition of a IPv6 input key handling function was causing
a crash in ulogd.
|
|
|
|
|
| |
This patch adds unloading of plugins (call dlclose()) in ulogd2. This
make valgrind happy and will be useful for daemon live reconfiguration.
|
|
|
|
|
|
|
|
|
| |
This patch cleans up the current key assignation by introducing a
set of functions ukey_* to set the key value as Eric Leblond and
we discussed during the latest Netfilter Workshop. This patch is
based on an idea from Holger Eitzenberger.
Signed-off-by: Eric Leblond <eric@inl.fr>
|
|
|
|
|
|
| |
This patch cleans up the key building by breaking lines at 80 columns and
it fixes the IPv6 support (use of a pointer after free) by introducing a new
128 bit type.
|
|
|
|
|
|
|
|
| |
structure. It can be used by input modules to duplicate an
entry. This solves the issue of not being able to use the same
plugin instance twice.
Signed-off-by: Eric Leblond <eric@inl.fr>
|
|
|
|
|
|
|
|
|
|
|
| |
can be use by MySQL. This is not strictly speaking raw data but it was of type
RAW.
Following remark from Hugo Mildenberger, I introduce in this patch a dedicated
type ULOGD_RET_RAWSTR. The main reason not to use a ULOGD_RET_STRING parameter
is that the paramater is not human readable.
Signed-off-by: Eric Leblond <eric@inl.fr>
|
|
|
|
| |
- fix crash when enabling pollinterval clause in flow-based accounting
|
|
|
|
|
|
|
| |
Some macros were defined several time. This was the case of GET_VALUE,
pp_is_valid. This patch puts the definition in ulogd.h and fixes the
definition of pp_is_valid which was wrong (causing segfault by acessing to
fields at NULL).
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
is now cluttering the namespace by its 'list_add' function.
|
| |
|
| |
|
|
|
|
| |
version
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
- add more sophisticated signal delivery to pluginstances
- partial LOGEMU port to ulogd2
|
| |
|
|
|
|
| |
notice
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
- defer file opens + other initialization until after setuid() was called
- cosmetic cleanup (no _ in static functions, use 'static' whenever possible)
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
(reported by Drori Ghiora)
- fixes logfile bug: wrong filename and line number displayed
- fixes logfile bug: logfile is fflush()ed after each line (reported by Drori Ghiora)
|
|
|
|
|
|
|
|
|
| |
- added hashtables everywhere
- no more dynamic allocation for each packet
- mysql output plugin
- more keys in ulogd_BASE
- moved libipulog into ulogd directory
- introduced autoconf
|
|
|
|
| |
- lot of bugfixes
|
|
|
|
|
|
| |
- no more dynamic allocations at runtime - only once at startup
- less list traversal through interpreter and key hashes
- output plugins can request only certain results!
|