summaryrefslogtreecommitdiffstats
path: root/output
Commit message (Collapse)AuthorAgeFilesLines
* pgsql: add var to specify arbitrary conn paramsEric Leblond2013-06-081-40/+47
| | | | | | | | | This patch adds a configuration variable for PostgreSQL output. Named connstring it stores the character string that will be used to connect to the PostgreSQL server. This allows the user to use all options available like TLS parameters for example. Signed-off-by: Eric Leblond <eric@regit.org>
* sqlite3: add sanity checkingEric Leblond2013-04-201-0/+2
| | | | Nullify sqlite3 handler at deinit.
* mysql: add sanity checkingEric Leblond2013-04-201-1/+3
| | | | Nullify mysql handler at deinit.
* postgresql: add sanity checkingEric Leblond2013-04-201-1/+3
| | | | Clean postgresql handler at deinit.
* logemu: return error if configuration is invalid.Eric Leblond2013-02-181-4/+1
|
* graphite: fix crash on i386Eric Leblond2013-02-171-2/+2
| | | | | | | | It seems a cast of time_t is needed for i386 system to avoid a crash. I've added a cast to uint64_t that should be ok on all Linux system. Reported-by: netfilter@openenterprise.co.uk
* graphite: fix warning about gnu extension usageEric Leblond2013-01-181-4/+4
| | | | | clang is complaining about missing = being a gnu extension. This patch adds equal sign to fix the warning.
* Get rid of SVN tag in comment.Eric Leblond2013-01-186-15/+3
| | | | This patch also update some copyright and licence declaration.
* Add GRAPHITE output module.Eric Leblond2012-12-272-1/+251
| | | | | | | Graphite is a web application which provide real-time visualization and storage of numeric time-series data. This patch adds a module named GRAPHITE which sends NFACCT accounting data to a graphite server.
* Add additional ip6 header fields to database scriptsBob Hockney2012-12-191-1/+1
| | | | | Rename internal keyname ip6.payload_len to remove "_" to facilitate this.
* Handle postgresql schemas correctlyBob Hockney2012-12-191-4/+31
| | | | Add 'schema' variable to look into corresponding schema.
* build: move remaining preprocessor flags into CPPFLAGSJan Engelhardt2012-11-272-5/+5
| | | | | | | | The flags retrieved from `pkg-config --cflags ...` are generally only preprocessor flags (mostly -I to point to the directories), since anything else would inconvenience downstream users. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: resolve compile error due to missing nfacct CPPFLAGSJan Engelhardt2012-11-271-1/+1
| | | | | | | | | | | | | | Fixes this error: make[3]: Entering directory "/home/jengelh/code/ulogd2/output" CC ulogd_output_XML.lo ulogd_output_XML.c:31:49: fatal error: libnetfilter_acct/libnetfilter_acct.h: No such file or directory (Note that pkgconfig-provided cflags are actually cppflags, so I add ${LIBNETFILTER_ACCT_CFLAGS} to AM_CPPFLAGS.) Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* XML: add missing includeEric Leblond2012-11-041-0/+2
| | | | | | Inclusion of libnetfilter_acct.h is not enough as the integer type definition are not included in the header. So if NFCT is disable, the compilation fails.
* Use PRIu64 to print unsigned 64bit intEric Leblond2012-11-042-2/+4
|
* configure: add flag to disable NFLOG buildEric Leblond2012-11-041-1/+7
|
* configure: add flag to disable NFCT buildEric Leblond2012-11-041-1/+7
|
* configure: add flag to disable NFACCT buildEric Leblond2012-11-041-1/+8
| | | | | | It is now possible to pass the --disable-nfacct flag to disable compilation of NFACCT input plugin. Doing this the build of ulogd is possible on system where nfacct is not available.
* ipfix: fix bracket imbalance if IPPROTO_SCTP is definedThomas Jarosch2012-08-061-0/+1
| | | | | | | Detected by cppcheck. Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix version that -V displaysPablo Neira Ayuso2012-08-0312-12/+12
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pgsql: only disable key if it starts with underscoreEric Leblond2012-08-031-2/+3
| | | | | | | | | | ulogd2 was magically making inactive the first key of description table. This patch improves this system by only doing so when the key start with an undescore. This way, system like nfacct which do not have a primary key can be implemented easily. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: Add more logging if database initialization fails.Michael Tremer2012-07-231-2/+6
| | | | | Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: display time for NFACCTPablo Neira Ayuso2012-06-221-1/+2
| | | | | | <obj><name>test</name><pkts>00000000000000000000</pkts><bytes>00000000000000000000</bytes><hour>17</hour><min>46</min><sec>47</sec><wday>6</wday><day>22</day><month>6</month><year>2012</year></obj> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: support for NFACCT input pluginPablo Neira Ayuso2012-06-222-2/+31
| | | | | | | | | This patch extends XML plugin to support NFACCT. You can use the following line in ulogd.conf to test it: stack=acct1:NFACCT,xml1:XML Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ULOGD_DTYPE_SUM for nfacct-based accountingPablo Neira Ayuso2012-06-221-1/+1
| | | | | | This new type will be used in flow-up patch to support XML output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pcap: resolve unreliable detectionJan Engelhardt2012-06-051-2/+2
| | | | | | | | | | | | pcap is not found reliably by either --with-pcap=%_prefix or --with-pcap-lib=%_libdir --with-pcap-inc=%_includedir. If you have any special paths, just use ./configure CPPFLAGS="-I/my/pcap" LDFLAGS="-L/my/pcap" (And -lpcap is already known so no need to specify that.) Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* sqlite: resolve compiler warningsJan Engelhardt2012-06-051-1/+1
| | | | | | | | | | | | | | | | In file included from /usr/include/string.h:642:0, from ulogd_output_SQLITE3.c:34: In function 'strncat', inlined from 'db_count_cols' at ulogd_output_SQLITE3.c:306:9, inlined from 'sqlite3_init_db' at ulogd_output_SQLITE3.c:328:11: /usr/include/bits/string3.h:152:3: warning: call to __builtin___strncat_chk might overflow destination buffer [enabled by default] I: Statement might be overflowing a buffer in strncat. Common mistake: BAD: strncat(buffer,charptr,sizeof(buffer)) is wrong, it takes the left over size as 3rd argument GOOD: strncat(buffer,charptr,sizeof(buffer)-strlen(buffer)-1) E: ulogd2 bufferoverflowstrncat ulogd_output_SQLITE3.c:328:11 Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-186-6/+6
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd2 / DBI / table nameHarald Welte2012-02-241-1/+4
| | | | | | | | | | | | | DBI: allow to define table name via table config option While using the DBI plugin of ulogd2 for NFCT based accounting, despite using table="conntrack", it always insisted in using the table "ulog" for deriving the keys/columns to be stored. I've hacked up a quick fix, and it seems to work as expected (though no proper null termination after strncpy). Signed-off-by: Harald Welte <laforge@netfilter.org>
* output: add GPRINT pluginPablo Neira Ayuso2012-02-222-1/+274
| | | | | | | | | | This patch adds GPRINT which is a generalization of OPRINT. It display the set of key-values separated by commas. This is the generic print that you can attach to whatever kind of input plugin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* OPRINT: display u64 fieldsPablo Neira Ayuso2012-02-221-0/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: remove automatic creation of table `daily'Pablo Neira Ayuso2011-02-251-39/+7
| | | | | | | | | | | | | | | | | | | This patch removes the creation of the `daily' table. Now, we assume that the table that we use are created before launching ulogd2. This code is broken because you have to specify in the configuration file that the table used is `daily', otherwise this `daily' table is created and dropped during the daemon starting, but not used. Moreover, the code explicit shows a message that it says: /* FIXME make this configurable */ So, I think that this patch is the way to go :-). This patch also documents the table creation in ulogd.sgml Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: fix warning during compilationPablo Neira Ayuso2011-02-251-1/+1
| | | | | | | | | This patch fixes the following warning during the compilation: ulogd_output_SQLITE3.c: In function ‘ulogd_find_key’: ulogd_output_SQLITE3.c:292: warning: comparison between signed and unsigned integer expressions Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: cleanup error handling of sqlite3_bind_int() in sqlite3_interp()Pablo Neira Ayuso2011-02-251-20/+4
| | | | | | | Move error handling after the switch statement since it's the same for all cases, we save several lines of code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: use continue instead of goto in sqlite3_interp()Pablo Neira Ayuso2011-02-251-3/+2
| | | | | | | | | Use continue instead of goto inside loop. I don't need to scroll up and down in the code to know what the jump is performing. I think this improve code readability. It's a comestic cleanup, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: simplify sqlite3 checkJan Engelhardt2011-02-251-3/+3
| | | | | | | | With pkg-config variables, even a non-installed sqlite3 can be configured easily. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: initial support extracted from Holger Eitzenberger's workPablo Neira Ayuso2011-02-241-259/+350
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch imports the sqlite3 support from Holger. I applied folded the following patches, that Harald passed to me during the last Netfilter workshop, into one: 0001-ulog2-sqlite-port-to-v2.diff.patch 0002-ulog2-sqlite-prepare-fix.diff.patch 0003-ulogd-sqlite-new-logging.diff.patch 0004-ulogd-accounting-add-flow-start-day.patch 0005-ulogd-sqlite3-err-codes-fix.dif.patch 0006-ulogd-sqlite3-tbl-corrupt-fix.diff.patch 0007-ulogd-sqlite3-handle-schema-change.diff.patch 0008-SQLITE3-count-instead-of-log-table-busy-messags.patch 0009-ulogd-SQLITE-Added-flowstartsec.diff.patch Harald passed them to me with no description, so applying them separately does not provide more information. I'll start adding patches on top on these so Holger can get in sync with my work. This also can help him to take my patches and to integrate them to his tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use compile/link information from pkgconfigJan Engelhardt2011-02-011-3/+5
| | | | | | | This is important for when the libraries are in a non-default path. Also, libs must be listed in LDADD/LIBADD, not LDFLAGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use appropriate location for program modulesJan Engelhardt2011-02-016-8/+8
| | | | | | | Modules - since they are dependent on the executable - generally go to libexec/. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: avoid use of LIBS variableJan Engelhardt2011-02-016-6/+5
| | | | | | | The variable contains global libraries linked into every possible object, which is unwanted. Clean up things. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: propagate global CFLAGSJan Engelhardt2010-11-056-0/+6
| | | | | | | | | We must not override CFLAGS, because that will break when the user overrides CFLAGS again at make time (which he is entitled to). So, name our CFLAGS regular_CFLAGS, and also include that across all Makefiles so that they are actually uesd for all the code. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* output/LOGEMU: resolve build warningJan Engelhardt2010-11-051-1/+1
| | | | | | | ulogd_output_LOGEMU.c:37:2: warning: #warning this libc does not define HOST_NAME_MAX Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused $(all_includes)Jan Engelhardt2010-11-056-6/+6
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* pcap: fix packet length handlingJan Andres2010-09-061-3/+21
| | | | | | | | | | | | | | | | | | | | | | | | Currently, the PCAP output plugin uses ip.totlen to determine both the "len" and "caplen" pcap header fields, as well as the amount of packet data written to the file. There are two issues with this: - For obvious reasons it doesn't work for IPv6. - AFAICT, in case of an incompletely captured packet (--nflog-range) it will attempt to write out the whole packet, not just the part captured. This patch changes the behavior to: - Use raw.pktlen to set the "caplen" field, and the amount of data written. - Determine the "len" (original length) field from ip.totlen or ip6.payload_len if possible, default to the same value as "caplen" otherwise. Signed-off-by: Jan Andres <jandres@gmx.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: remove plugin until it is usablePablo Neira Ayuso2010-06-171-4/+1
| | | | | | | | | This patch removes the IPFIX from the Makefile. Thus, we keep it in the tree in the hope that we'll have time to finish it in the future but don't compile it. This confuses users since they think that it works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: add infix in output filePablo Neira Ayuso2010-06-171-1/+12
| | | | | | | | | | This patch adds an infix to the XML file to avoid problems if we are logging packets and flows at the same time. Thus, we create two different XML files whose filename describes the sort of logging information that it contains. It is also useful when listing files at a quick sight. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: support reopening file via SIGHUPPablo Neira Ayuso2010-06-171-27/+63
| | | | | | This feature is useful for log-rotation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: add new plugin XML to output logs in XMLPablo Neira Ayuso2010-06-172-1/+246
| | | | | | | This patch adds XML that allows to log information in XML for ulogd2. It supports packet and flow-based accounting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* LOGEMU: fix crash if output file cannot be accessedPablo Neira Ayuso2010-06-031-1/+1
| | | | | | This patch fixes a crash if the output file was not correctly opened. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: preliminary fixes, yet unusablePablo Neira Ayuso2009-07-291-9/+5
| | | | | | | | | This patch is a preliminary fix for the yet-unfinished IPFIX support. This patch resolves a couple of bugs that made ulogd crash and a couple of missing symbols that didn't allow to use this plugin in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>