updated loggers file name foo

diff --git a/ChangeLog b/ChangeLog
index ef0a38fe8867aac66cf688df6048be2ab97a824f..5fc0d1833995ec97190d720c0ab798917da4a087 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,8 @@
 -- updated usage
 -- removed ! from error messages
 -- fixed command line vs conf output configs
+-- moved log_tcpdump to log_pcap
+-- changed all output filename configs to be based on module name
 
 122
 -- pulled thread pinning from Josh

diff --git a/src/loggers/CMakeLists.txt b/src/loggers/CMakeLists.txt
index 9a4cf77d099e769004a5469fd6ac5502910b4eb9..5c9cbd661c161ca2de379f9335ba5b02198a4857 100644 (file)
--- a/src/loggers/CMakeLists.txt
+++ b/src/loggers/CMakeLists.txt
@@ -16,7 +16,7 @@ set (PLUGIN_LIST
     alert_test.cc
     alert_unixsock.cc
     log_null.cc
-    log_tcpdump.cc
+    log_pcap.cc
     unified2.cc
     unified2_common.h
 )
@@ -49,7 +49,7 @@ else (STATIC_LOGGERS)
     add_shared_library(alert_test loggers alert_test.cc)
     add_shared_library(alert_unixsock loggers alert_unixsock.cc)
     add_shared_library(log_null loggers log_null.cc)
-    add_shared_library(log_tcpdump loggers log_tcpdump.cc)
+    add_shared_library(log_pcap loggers log_pcap.cc)
     add_shared_library(unified2 loggers unified2.cc unified2_common.h)
 
 endif (STATIC_LOGGERS)

diff --git a/src/loggers/Makefile.am b/src/loggers/Makefile.am
index b3b1d1bb59fe8e2104dcbcdf25c7d618f52ee3da..786b0807f5268585b6a81a70d3c4c78efef5675a 100644 (file)
--- a/src/loggers/Makefile.am
+++ b/src/loggers/Makefile.am
@@ -15,7 +15,7 @@ alert_syslog.cc \
 alert_test.cc \
 alert_unixsock.cc \
 log_null.cc \
-log_tcpdump.cc \
+log_pcap.cc \
 unified2.cc \
 unified2_common.h
 
@@ -65,10 +65,10 @@ liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
 liblog_null_la_LDFLAGS = -export-dynamic -shared
 liblog_null_la_SOURCES = log_null.cc
 
-ehlib_LTLIBRARIES += liblog_tcpdump.la
-liblog_tcpdump_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-liblog_tcpdump_la_LDFLAGS = -export-dynamic -shared
-liblog_tcpdump_la_SOURCES = log_tcpdump.cc
+ehlib_LTLIBRARIES += liblog_pcap.la
+liblog_pcap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+liblog_pcap_la_LDFLAGS = -export-dynamic -shared
+liblog_pcap_la_SOURCES = log_pcap.cc
 
 ehlib_LTLIBRARIES += libunified2.la
 libunified2_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO

diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc
index e8135d20f02679152cb98f7c8d2c2de1bf4b1e85..7f4a99a98f7e355bf78636ab2f5638b13b964446 100644 (file)
--- a/src/loggers/alert_csv.cc
+++ b/src/loggers/alert_csv.cc
@@ -51,7 +51,8 @@
 
 static THREAD_LOCAL TextLog* csv_log;
 
-static const char* s_name = "alert_csv";
+#define S_NAME "alert_csv"
+#define F_NAME S_NAME ".txt"
 
 using namespace std;
 
@@ -73,10 +74,8 @@ static const char* csv_deflt =
 
 static const Parameter s_params[] =
 {
-    // FIXIT-M provide PT_FILE and PT_PATH and enforce no
-    // path chars in file (outputs file must be in instance dir)
-    { "file", Parameter::PT_STRING, nullptr, "stdout",
-      "name of alert file" },
+    { "file", Parameter::PT_BOOL, nullptr, "false",
+      "output to " F_NAME " instead of stdout" },
 
     { "csv", Parameter::PT_MULTI, csv_range, csv_deflt,
       "selected fields will be output in given order left to right" },
@@ -97,13 +96,13 @@ static const char* s_help =
 class CsvModule : public Module
 {
 public:
-    CsvModule() : Module(s_name, s_help, s_params) { };
+    CsvModule() : Module(S_NAME, s_help, s_params) { };
     bool set(const char*, Value&, SnortConfig*);
     bool begin(const char*, int, SnortConfig*);
     bool end(const char*, int, SnortConfig*);
 
 public:
-    string file;
+    bool file;
     string csvargs;
     unsigned long limit;
     unsigned units;
@@ -112,7 +111,7 @@ public:
 bool CsvModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("file") )
-        file = v.get_string();
+        file = v.get_bool();
 
     else if ( v.is("csv") )
         csvargs = SnortStrdup(v.get_string());
@@ -131,7 +130,7 @@ bool CsvModule::set(const char*, Value& v, SnortConfig*)
 
 bool CsvModule::begin(const char*, int, SnortConfig*)
 {
-    file = "stdout";
+    file = false;
     limit = 0;
     units = 0;
     csvargs = csv_deflt;
@@ -170,7 +169,7 @@ public:
 
 CsvLogger::CsvLogger(CsvModule* m)
 {
-    file = m->file;
+    file = m->file ? F_NAME : "stdout";
     limit = m->limit;
     args = mSplit(m->csvargs.c_str(), " \n\t", 0, &numargs, 0);
 }
@@ -426,7 +425,7 @@ static LogApi csv_api
 {
     {
         PT_LOGGER,
-        s_name,
+        S_NAME,
         s_help,
         LOGAPI_PLUGIN_V0,
         0,

diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index ac15d5bb73a0abb339cb06c1067fbe4c632037cc..c86d86e92c6b92099bfb4d925f90a24b3ebfa8a0 100644 (file)
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -72,7 +72,8 @@ static THREAD_LOCAL TextLog* fast_log = nullptr;
 
 using namespace std;
 
-static const char* s_name = "alert_fast";
+#define S_NAME "alert_fast"
+#define F_NAME S_NAME ".txt"
 
 //-------------------------------------------------------------------------
 // module stuff
@@ -80,8 +81,8 @@ static const char* s_name = "alert_fast";
 
 static const Parameter s_params[] =
 {
-    { "file", Parameter::PT_STRING, nullptr, "stdout",
-      "name of alert file" },
+    { "file", Parameter::PT_BOOL, nullptr, "false",
+      "output to " F_NAME " instead of stdout" },
 
     { "packet", Parameter::PT_BOOL, nullptr, "true",
       "output packet dump with alert" },
@@ -101,13 +102,13 @@ static const char* s_help =
 class FastModule : public Module
 {
 public:
-    FastModule() : Module(s_name, s_help, s_params) { };
+    FastModule() : Module(S_NAME, s_help, s_params) { };
     bool set(const char*, Value&, SnortConfig*);
     bool begin(const char*, int, SnortConfig*);
     bool end(const char*, int, SnortConfig*);
 
 public:
-    string file;
+    bool file;
     unsigned long limit;
     unsigned units;
     bool packet;
@@ -116,7 +117,7 @@ public:
 bool FastModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("file") )
-        file = v.get_string();
+        file = v.get_bool();
 
     else if ( v.is("packet") )
         packet = v.get_bool();
@@ -135,7 +136,7 @@ bool FastModule::set(const char*, Value& v, SnortConfig*)
 
 bool FastModule::begin(const char*, int, SnortConfig*)
 {
-    file = "stdout";
+    file = false;
     limit = 0;
     units = 0;
     packet = true;
@@ -171,7 +172,7 @@ private:
 
 FastLogger::FastLogger(FastModule* m)
 {
-    file = m->file;
+    file = m->file ? F_NAME : "stdout";
     limit = m->limit;
     packet = m->packet;
 }
@@ -280,7 +281,7 @@ static LogApi fast_api
 {
     {
         PT_LOGGER,
-        s_name,
+        S_NAME,
         s_help,
         LOGAPI_PLUGIN_V0,
         0,

diff --git a/src/loggers/alert_full.cc b/src/loggers/alert_full.cc
index 5e199c554a26f6754109f3c00d17736c8f6edbb8..b364d3d377895b401c79574f8c4927d43ca27e4d 100644 (file)
--- a/src/loggers/alert_full.cc
+++ b/src/loggers/alert_full.cc
@@ -64,7 +64,8 @@ static THREAD_LOCAL TextLog* full_log = nullptr;
 
 using namespace std;
 
-static const char* s_name = "alert_full";
+#define S_NAME "alert_full"
+#define F_NAME S_NAME ".txt"
 
 //-------------------------------------------------------------------------
 // module stuff
@@ -72,8 +73,8 @@ static const char* s_name = "alert_full";
 
 static const Parameter s_params[] =
 {
-    { "file", Parameter::PT_STRING, nullptr, nullptr,
-      "name of alert file" },
+    { "file", Parameter::PT_BOOL, nullptr, "false",
+      "output to " F_NAME " instread of stdout" },
 
     { "limit", Parameter::PT_INT, "0:", "0",
       "set limit (0 is unlimited)" },
@@ -90,13 +91,13 @@ static const char* s_help =
 class FullModule : public Module
 {
 public:
-    FullModule() : Module(s_name, s_help, s_params) { };
+    FullModule() : Module(S_NAME, s_help, s_params) { };
     bool set(const char*, Value&, SnortConfig*);
     bool begin(const char*, int, SnortConfig*);
     bool end(const char*, int, SnortConfig*);
 
 public:
-    string file;
+    bool file;
     unsigned long limit;
     unsigned units;
 };
@@ -104,7 +105,7 @@ public:
 bool FullModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("file") )
-        file = v.get_string();
+        file = v.get_bool();
 
     else if ( v.is("limit") )
         limit = v.get_long();
@@ -120,7 +121,7 @@ bool FullModule::set(const char*, Value& v, SnortConfig*)
 
 bool FullModule::begin(const char*, int, SnortConfig*)
 {
-    file = "stdout";
+    file = false;
     limit = 0;
     units = 0;
     return true;
@@ -154,7 +155,7 @@ private:
 
 FullLogger::FullLogger(FullModule* m)
 {
-    file = m->file;
+    file = m->file ? F_NAME : "stdout";
     limit = m->limit;
 }
 
@@ -271,7 +272,7 @@ static LogApi full_api
 {
     {
         PT_LOGGER,
-        s_name,
+        S_NAME,
         s_help,
         LOGAPI_PLUGIN_V0,
         0,

diff --git a/src/loggers/alert_test.cc b/src/loggers/alert_test.cc
index 88c6353d96935d9c1a5b2b28a71d2a0f7e9b3cf8..54ae28d0d6400ecd3714cedf9d548823dd91034d 100644 (file)
--- a/src/loggers/alert_test.cc
+++ b/src/loggers/alert_test.cc
@@ -58,7 +58,8 @@ static THREAD_LOCAL TextLog* test_file = nullptr;
 
 using namespace std;
 
-static const char* s_name = "alert_test";
+#define S_NAME "alert_test"
+#define F_NAME S_NAME ".txt"
 
 //-------------------------------------------------------------------------
 // alert_test module
@@ -67,7 +68,7 @@ static const char* s_name = "alert_test";
 static const Parameter s_params[] =
 {
     { "file", Parameter::PT_BOOL, nullptr, "false",
-      "if true, output to alert_csv.txt instead of stdout" },
+      "output to " F_NAME " instead of stdout" },
 
     { "rebuilt", Parameter::PT_BOOL, nullptr, "false",
       "include type:count where type is S for stream and F for frag" },
@@ -87,7 +88,7 @@ static const char* s_help =
 class TestModule : public Module
 {
 public:
-    TestModule() : Module(s_name, s_help, s_params) { };
+    TestModule() : Module(S_NAME, s_help, s_params) { };
 
     bool set(const char*, Value&, SnortConfig*);
     bool begin(const char*, int, SnortConfig*);
@@ -152,7 +153,7 @@ TestLogger::TestLogger(TestModule* m)
 
 void TestLogger::open()
 {
-    const char* f =  (flags & TEST_FLAG_FILE) ? "alert_csv.txt" : "stdout";
+    const char* f =  (flags & TEST_FLAG_FILE) ? F_NAME : "stdout";
     test_file = TextLog_Init(f);
 }
 
@@ -222,7 +223,7 @@ static LogApi test_api
 {
     {
         PT_LOGGER,
-        s_name,
+        S_NAME,
         s_help,
         LOGAPI_PLUGIN_V0,
         0,

diff --git a/src/loggers/log_codecs.cc b/src/loggers/log_codecs.cc
index 194b7fbed52e9ee9abc96b8a35ab64e2d662ffe8..0dc605b21e62e9eac7adde8d533aa569134bfe18 100644 (file)
--- a/src/loggers/log_codecs.cc
+++ b/src/loggers/log_codecs.cc
@@ -39,6 +39,7 @@
 
 
 static THREAD_LOCAL TextLog* test_file = nullptr;
+#define F_NAME "dump.txt"
 
 //-------------------------------------------------------------------------
 // module stuff
@@ -48,11 +49,12 @@ static THREAD_LOCAL TextLog* test_file = nullptr;
 #define LOG_CODECS_HELP "log protocols in packet by layer"
 
 static const unsigned ALERT_FLAG_MSG = 0x01;
+static const unsigned ALERT_FLAG_FILE = 0x02;
 
 static const Parameter ex_params[] =
 {
-    { "file", Parameter::PT_STRING, nullptr, "stdout",
-      "name of tsv alert file or 'stdout'" },
+    { "file", Parameter::PT_BOOL, nullptr, "stdout",
+      "output to " F_NAME " instead of stdout" },
 
     { "msg", Parameter::PT_BOOL, nullptr, "false",
       "include alert msg" },
@@ -71,7 +73,6 @@ public:
     bool begin(const char*, int, SnortConfig*);
 
 public:
-    std::string file;
     uint8_t flags;
 };
 
@@ -80,8 +81,10 @@ public:
 bool LogCodecModule::set(const char*, Value& v, SnortConfig*)
 {
     if ( v.is("file") )
-        file = v.get_string();
-
+    {
+        if ( v.get_bool() )
+            flags |= ALERT_FLAG_FILE;
+    }
     else if ( v.is("msg") )
     {
         if ( v.get_bool() )
@@ -96,7 +99,6 @@ bool LogCodecModule::set(const char*, Value& v, SnortConfig*)
 
 bool LogCodecModule::begin(const char*, int, SnortConfig*)
 {
-    file = "stdout";
     flags = 0;
     return true;
 }
@@ -126,7 +128,6 @@ public:
 
 CodecLogger::CodecLogger(LogCodecModule* m)
 {
-    file = m->file;
     flags = m->flags;
 }
 
@@ -156,17 +157,9 @@ void CodecLogger::log(Packet* p, const char* msg, Event* e)
             TextLog_Print(test_file, "%s\t", msg);
     }
 
-    TextLog_NewLine(test_file);
-    TextLog_Print(test_file, " **** DUMPING PACKET ****");
     TextLog_NewLine(test_file);
     PacketManager::log_protocols(test_file, p);
     TextLog_NewLine(test_file);
-    TextLog_Print(test_file, " **** FINISHED DUMPING ****");
-    TextLog_NewLine(test_file);
-    TextLog_NewLine(test_file);
-    TextLog_NewLine(test_file);
-    TextLog_NewLine(test_file);
-
 }
 
 //-------------------------------------------------------------------------

diff --git a/src/loggers/log_tcpdump.cc b/src/loggers/log_pcap.cc
similarity index 92%
rename from src/loggers/log_tcpdump.cc
rename to src/loggers/log_pcap.cc
index 47d381959cb270178b0acc300ab87880b9d14754..df3d35213a3242d181e3d58f2424d84b14b934cd 100644 (file)
--- a/src/loggers/log_tcpdump.cc
+++ b/src/loggers/log_pcap.cc
@@ -83,7 +83,8 @@ static THREAD_LOCAL LtdContext context;
 
 static void TcpdumpRollLogFile(LtdConfig*);
 
-static const char* s_name = "log_tcpdump";
+#define S_NAME "log_pcap"
+#define F_NAME S_NAME "log.pcap"
 
 //-------------------------------------------------------------------------
 // module stuff
@@ -91,9 +92,6 @@ static const char* s_name = "log_tcpdump";
 
 static const Parameter s_params[] =
 {
-    { "file", Parameter::PT_STRING, nullptr, "snort.pcap",
-      "name of alert file" },
-
     { "limit", Parameter::PT_INT, "0:", "0",
       "set limit (0 is unlimited)" },
 
@@ -109,23 +107,19 @@ static const char* s_help =
 class TcpdumpModule : public Module
 {
 public:
-    TcpdumpModule() : Module(s_name, s_help, s_params) { };
+    TcpdumpModule() : Module(S_NAME, s_help, s_params) { };
     bool set(const char*, Value&, SnortConfig*);
     bool begin(const char*, int, SnortConfig*);
     bool end(const char*, int, SnortConfig*);
 
 public:
-    string file;
     unsigned limit;
     unsigned units;
 };
 
 bool TcpdumpModule::set(const char*, Value& v, SnortConfig*)
 {
-   if ( v.is("file") )
-        file = v.get_string();
-
-    else if ( v.is("limit") )
+    if ( v.is("limit") )
         limit = v.get_long();
 
     else if ( v.is("units") )
@@ -139,7 +133,6 @@ bool TcpdumpModule::set(const char*, Value& v, SnortConfig*)
 
 bool TcpdumpModule::begin(const char*, int, SnortConfig*)
 {
-    file = "snort.pcap";
     limit = 0;
     units = 0;
     return true;
@@ -219,12 +212,12 @@ static void LogTcpdumpStream(
     }
 }
 
-static void TcpdumpInitLogFile(LtdConfig* data, int /*nostamps?*/)
+static void TcpdumpInitLogFile(LtdConfig*, int /*nostamps?*/)
 {
     context.lastTime = time(NULL);
 
     string file;
-    get_instance_file(file, data->file.c_str());
+    get_instance_file(file, F_NAME);
 
     {
         pcap_t* pcap;
@@ -238,14 +231,14 @@ static void TcpdumpInitLogFile(LtdConfig* data, int /*nostamps?*/)
         pcap = pcap_open_dead(dlt, DAQ_GetSnapLen());
 
         if ( !pcap )
-            FatalError("%s: can't get pcap context\n", s_name);
+            FatalError("%s: can't get pcap context\n", S_NAME);
 
         context.dumpd = pcap ? pcap_dump_open(pcap, file.c_str()) : NULL;
 
         if(context.dumpd == NULL)
         {
             FatalError("%s: can't open %s: %s\n",
-                s_name, file.c_str(), pcap_geterr(pcap));
+                S_NAME, file.c_str(), pcap_geterr(pcap));
         }
         pcap_close(pcap);
     }
@@ -318,7 +311,6 @@ private:
 PcapLogger::PcapLogger(TcpdumpModule* m)
 {
     config = new LtdConfig;
-    config->file = m->file;
     config->limit = m->limit;
 }
 
@@ -377,7 +369,7 @@ static LogApi tcpdump_api
 {
     {
         PT_LOGGER,
-        s_name,
+        S_NAME,
         s_help,
         LOGAPI_PLUGIN_V0,
         0,
@@ -396,6 +388,6 @@ SO_PUBLIC const BaseApi* snort_plugins[] =
     nullptr
 };
 #else
-const BaseApi* log_tcpdump = &tcpdump_api.base;
+const BaseApi* log_pcap = &tcpdump_api.base;
 #endif
 

diff --git a/src/loggers/loggers.cc b/src/loggers/loggers.cc
index dda8a989a60558af2c076d6395b94fe32cce584c..10948b6858fb7dc9b101d374e4ef78cafb66ccc1 100644 (file)
--- a/src/loggers/loggers.cc
+++ b/src/loggers/loggers.cc
@@ -42,7 +42,7 @@ extern const BaseApi* alert_syslog;
 extern const BaseApi* alert_test;
 extern const BaseApi* alert_unix_sock;
 extern const BaseApi* log_null;
-extern const BaseApi* log_tcpdump;
+extern const BaseApi* log_pcap;
 extern const BaseApi* eh_unified2;
 #endif
 
@@ -62,7 +62,7 @@ const BaseApi* loggers[] =
     alert_unix_sock,
     // loggers
     log_null,
-    log_tcpdump,
+    log_pcap,
 
     // both
     eh_unified2,

diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc
index 04241a6157c43d7146600fb66f0e1c6a67ae7090..d7a15b9b3e5b7d59d271bd768afdcf7706f49924 100644 (file)
--- a/src/loggers/unified2.cc
+++ b/src/loggers/unified2.cc
@@ -68,12 +68,12 @@
 
 using namespace std;
 
-static const char* s_name = "unified2";
+#define S_NAME "unified2"
+#define F_NAME S_NAME "log.u2"
 
 /* ------------------ Data structures --------------------------*/
 typedef struct _Unified2Config
 {
-    string base_filename;
     unsigned int limit;
     int nostamp;
     int mpls_event_types;
@@ -1048,9 +1048,6 @@ static void Unified2Write(uint8_t *buf, uint32_t buf_len, Unified2Config *config
 
 static const Parameter s_params[] =
 {
-    { "file", Parameter::PT_STRING, nullptr, "unified2.log",
-      "name of alert file" },
-
     { "limit", Parameter::PT_INT, "0:", "0",
       "set limit (0 is unlimited)" },
 
@@ -1075,13 +1072,12 @@ static const char* s_help =
 class U2Module : public Module
 {
 public:
-    U2Module() : Module(s_name, s_help, s_params) { };
+    U2Module() : Module(S_NAME, s_help, s_params) { };
     bool set(const char*, Value&, SnortConfig*);
     bool begin(const char*, int, SnortConfig*);
     bool end(const char*, int, SnortConfig*);
 
 public:
-    string file;
     unsigned limit;
     unsigned units;
     bool nostamp;
@@ -1091,10 +1087,7 @@ public:
 
 bool U2Module::set(const char*, Value& v, SnortConfig*)
 {
-   if ( v.is("file") )
-        file = v.get_string();
-
-    else if ( v.is("limit") )
+    if ( v.is("limit") )
         limit = v.get_long();
 
     else if ( v.is("units") )
@@ -1117,7 +1110,6 @@ bool U2Module::set(const char*, Value& v, SnortConfig*)
 
 bool U2Module::begin(const char*, int, SnortConfig*)
 {
-    file = "unified2.log";
     limit = 0;
     units = 0;
     nostamp = ScNoOutputTimestamp();
@@ -1154,7 +1146,6 @@ private:
 
 U2Logger::U2Logger(U2Module* m)
 {
-    config.base_filename = m->file;
     config.limit = m->limit;
     config.nostamp = m->nostamp;
     config.mpls_event_types = m->mpls;
@@ -1169,7 +1160,7 @@ void U2Logger::open()
     int status;
 
     std::string name;
-    get_instance_file(name, config.base_filename.c_str());
+    get_instance_file(name, F_NAME);
 
     status = SnortSnprintf(
         u2.filepath, sizeof(u2.filepath), "%s", name.c_str());
@@ -1268,7 +1259,7 @@ static LogApi u2_api
 {
     {
         PT_LOGGER,
-        s_name,
+        S_NAME,
         s_help,
         LOGAPI_PLUGIN_V0,
         0,

diff --git a/src/network_inspectors/perf_monitor/perf_module.cc b/src/network_inspectors/perf_monitor/perf_module.cc
index c738d2b712f6aaadbefb318e7e92c2039ca1908a..51a139d0584cd6227b1c842803a73c679bd91584 100644 (file)
--- a/src/network_inspectors/perf_monitor/perf_module.cc
+++ b/src/network_inspectors/perf_monitor/perf_module.cc
@@ -22,6 +22,10 @@
 #include "perf_module.h"
 #include "utils/util.h"
 
+#define PERF_FILE "perf_monitor.csv"
+#define FLOW_FILE "perf_monitor_flow.csv"
+#define FLIP_FILE "perf_monitor_flow_ip.csv"
+
 //-------------------------------------------------------------------------
 // perf attributes
 //-------------------------------------------------------------------------
@@ -56,19 +60,19 @@ static const Parameter s_params[] =
       "report on qualified vs non-qualified events" },
 
     { "file", Parameter::PT_BOOL, nullptr, "false",
-      "otuput base stats to a csv file" },
+      "otuput base stats to " PERF_FILE " instead of stdout" },
 
     { "flow", Parameter::PT_BOOL, nullptr, "false",
       "enable traffic statistics" },
 
     { "flow_file", Parameter::PT_BOOL, nullptr, "false",
-      "output traffic statistics to a csv file" },
+      "output traffic statistics to a " FLOW_FILE " instead of stdout" },
 
     { "flow_ip", Parameter::PT_BOOL, nullptr, "false",
       "enable statistics on host pairs" },
 
     { "flow_ip_file", Parameter::PT_BOOL, nullptr, "false",
-      "output host pair statistics to csv file" },
+      "output host pair statistics to " FLIP_FILE " instead of stdout" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -128,7 +132,7 @@ bool PerfMonModule::set(const char*, Value& v, SnortConfig*)
     else if ( v.is("file") )
     {
         if ( v.get_bool() )
-            config.file = SnortStrdup("perf_monitor.csv");
+            config.file = SnortStrdup(PERF_FILE);
     }
     else if ( v.is("flow") )
     {
@@ -140,7 +144,7 @@ bool PerfMonModule::set(const char*, Value& v, SnortConfig*)
         if ( v.get_bool() )
         {
             config.perf_flags |= SFPERF_FLOW;
-            config.flow_file = SnortStrdup("perf_monitor_flow.csv");
+            config.flow_file = SnortStrdup(FLOW_FILE);
         }
     }
     else if ( v.is("flow_ip") )
@@ -153,7 +157,7 @@ bool PerfMonModule::set(const char*, Value& v, SnortConfig*)
         if ( v.get_bool() )
         {
             config.perf_flags |= SFPERF_FLOWIP;
-            config.flowip_file = SnortStrdup("perf_monitor_flow_ip.csv");
+            config.flowip_file = SnortStrdup(FLIP_FILE);
         }
     }
     else

diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc
index 93f40dd11afb1dd685c436954294ef218160776f..87c13b51839669c3d1661bb40f2c0d092efd46a3 100644 (file)
--- a/src/parser/config_file.cc
+++ b/src/parser/config_file.cc
@@ -69,7 +69,7 @@
 
 #define OUTPUT_AJK  "unified2"
 #define OUTPUT_CMG  "alert_fast"
-#define OUTPUT_PCAP "log_tcpdump"
+#define OUTPUT_PCAP "log_pcap"
 
 static std::string lua_conf;
 static std::string snort_conf_dir;