1 /* @(#) $Id: ./src/logcollector/read_ossecalert.c, 2012/03/30 dcid Exp $
4 /* Copyright (C) 2012 Daniel B. Cid (http://dcid.me)
7 * This program is a free software; you can redistribute it
8 * and/or modify it under the terms of the GNU General Public
9 * License (version 2) as published by the FSF - Free Software
17 #include "headers/read-alert.h"
18 #include "logcollector.h"
22 /* Read syslog files/snort fast/apache files */
23 void *read_ossecalert(int pos, int *rc, int drop_it)
31 char syslog_msg[OS_SIZE_2048 +1];
33 al_data = GetAlertData(0, logff[pos].fp);
40 memset(syslog_msg, '\0', OS_SIZE_2048 +1);
44 /* Adding source ip. */
46 ((al_data->srcip[0] == '(') &&
47 (al_data->srcip[1] == 'n') &&
48 (al_data->srcip[2] == 'o')))
54 snprintf(srcip_msg, 255, " srcip: %s;", al_data->srcip);
58 /* Adding username. */
60 ((al_data->user[0] == '(') &&
61 (al_data->user[1] == 'n') &&
62 (al_data->user[2] == 'o')))
68 snprintf(user_msg, 255, " user: %s;", al_data->user);
72 if(al_data->log[1] == NULL)
74 /* Building syslog message. */
75 snprintf(syslog_msg, OS_SIZE_2048,
76 "ossec: Alert Level: %d; Rule: %d - %s; "
77 "Location: %s;%s%s %s",
78 al_data->level, al_data->rule, al_data->comment,
89 while(al_data->log[j] != NULL)
91 tmp_msg = os_LoadString(tmp_msg, al_data->log[j]);
92 tmp_msg = os_LoadString(tmp_msg, "\n");
95 FreeAlertData(al_data);
100 if(strlen(tmp_msg) > 1596)
105 tmp_msg[1597] = '\0';
107 snprintf(syslog_msg, OS_SIZE_2048,
108 "ossec: Alert Level: %d; Rule: %d - %s; "
109 "Location: %s;%s%s %s",
110 al_data->level, al_data->rule, al_data->comment,
118 /* Clearing the memory */
119 FreeAlertData(al_data);
123 /* Sending message to queue */
126 if(SendMSG(logr_queue,syslog_msg,logff[pos].file, LOCALFILE_MQ) < 0)
128 merror(QUEUE_SEND, ARGV0);
129 if((logr_queue = StartMQ(DEFAULTQPATH,WRITE)) < 0)
131 ErrorExit(QUEUE_FATAL, ARGV0, DEFAULTQPATH);