counters: improve handling missing global config

Improve warnings when eve.stats can't work because of the global config
missing or disabled.

Issue warning if global config is missing but stats are still enabled due
to the legacy stats.log.

Issue clearer warning when stats are disabled and unix socket dump-counters
command is issued.

Warnings include links to docs.

Bug #2465.

diff --git a/src/counters.c b/src/counters.c
index 0bc808dfd3687303e8c5b707fe2c772429df1f56..7f863b75ef878858d98826fa8e33c9ef6cdf9258 100644 (file)
--- a/src/counters.c
+++ b/src/counters.c
@@ -245,6 +245,14 @@ static void StatsInitCtxPreOutput(void)
             SCLogDebug("Stats module has been disabled");
             SCReturn;
         }
+        /* warn if we are using legacy config to enable stats */
+        ConfNode *gstats = ConfGetNode("stats");
+        if (gstats == NULL) {
+            SCLogWarning(SC_ERR_STATS_LOG_GENERIC, "global stats config is missing. "
+                    "Stats enabled through legacy stats.log. "
+                    "See %s%s/configuration/suricata-yaml.html#stats", DOC_URL, DOC_VERSION);
+        }
+
         const char *interval = ConfNodeLookupChildValue(stats, "interval");
         if (interval != NULL)
             stats_tts = (uint32_t) atoi(interval);
@@ -280,7 +288,7 @@ static void StatsInitCtxPostOutput(void)
         exit(EXIT_FAILURE);
     }
 
-    if (!OutputStatsLoggersRegistered()) {
+    if (stats_enabled && !OutputStatsLoggersRegistered()) {
         stats_loggers_active = 0;
 
         /* if the unix command socket is enabled we do the background
@@ -809,15 +817,19 @@ TmEcode StatsOutputCounterSocket(json_t *cmd,
     json_t *message = NULL;
     TmEcode r = TM_ECODE_OK;
 
-    SCMutexLock(&stats_table_mutex);
-    if (stats_table.start_time == 0) {
+    if (!stats_enabled) {
         r = TM_ECODE_FAILED;
-        message = json_string("stats not yet synchronized");
+        message = json_string("stats are disabled in the config");
     } else {
-        message = StatsToJSON(&stats_table, JSON_STATS_TOTALS|JSON_STATS_THREADS);
+        SCMutexLock(&stats_table_mutex);
+        if (stats_table.start_time == 0) {
+            r = TM_ECODE_FAILED;
+            message = json_string("stats not yet synchronized");
+        } else {
+            message = StatsToJSON(&stats_table, JSON_STATS_TOTALS|JSON_STATS_THREADS);
+        }
+        SCMutexUnlock(&stats_table_mutex);
     }
-    SCMutexUnlock(&stats_table_mutex);
-
     json_object_set_new(answer, "message", message);
     return r;
 }

diff --git a/src/output-json-stats.c b/src/output-json-stats.c
index b22b8df7cf192311fd904b1effa2e031a743866c..f498839da989f95c7e826bc92506698fccadbe16 100644 (file)
--- a/src/output-json-stats.c
+++ b/src/output-json-stats.c
@@ -383,6 +383,14 @@ static void OutputStatsLogDeinit(OutputCtx *output_ctx)
 static OutputInitResult OutputStatsLogInit(ConfNode *conf)
 {
     OutputInitResult result = { NULL, false };
+
+    if (!StatsEnabled()) {
+        SCLogError(SC_ERR_STATS_LOG_GENERIC,
+                "stats.json: stats are disabled globally: set stats.enabled to true. "
+                "See %s%s/configuration/suricata-yaml.html#stats", DOC_URL, DOC_VERSION);
+        return result;
+    }
+
     LogFileCtx *file_ctx = LogFileNewCtx();
     if(file_ctx == NULL) {
         SCLogError(SC_ERR_STATS_LOG_GENERIC, "couldn't create new file_ctx");
@@ -455,6 +463,14 @@ static OutputInitResult OutputStatsLogInitSub(ConfNode *conf, OutputCtx *parent_
 {
     OutputInitResult result = { NULL, false };
     OutputJsonCtx *ajt = parent_ctx->data;
+
+    if (!StatsEnabled()) {
+        SCLogError(SC_ERR_STATS_LOG_GENERIC,
+                "eve.stats: stats are disabled globally: set stats.enabled to true. "
+                "See %s%s/configuration/suricata-yaml.html#stats", DOC_URL, DOC_VERSION);
+        return result;
+    }
+
     OutputStatsCtx *stats_ctx = SCMalloc(sizeof(OutputStatsCtx));
     if (unlikely(stats_ctx == NULL))
         return result;