1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
|
/*
Copyright (C) 2021 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <string>
#include <stdlib.h>
#include <stddef.h>
#include <time.h>
#include <stdio.h>
using namespace std;
class cycle_writer {
public:
//
// The conclusion is what consider() tells you to do
// after you tell it how many more bytes to consider.
//
// We don't deal directly with file pointers here to
// keep the concerns separated. This engine only advises
// a course of action.
//
enum conclusion {
// Continue to use the same file
SAMEFILE,
// Close the current file handle
// and use the one in get_current_file_name()
NEWFILE,
// It's the end of the capture,
// close the file handle and exit.
// (actually never used, but kept for future
// implementations and backwards compatibility)
DOQUIT
};
cycle_writer(bool is_live);
~cycle_writer()
{
if(m_past_names != NULL)
{
delete[] m_past_names;
}
};
//
// Setup sets all the parameters of the
// engine in one go so you don't miss anything.
//
// Also, if the engine has already started
// (via a call to consider()), then this will
// be locked down and return false.
//
bool setup(string base_file_name, int rollover_mb, int duration_seconds, int file_limit, unsigned long event_limit, scap_dumper_t** dumper);
//
// Consider file size at the current time
// and tell us whether
//
// * a new file should be written,
// * we should use the same file, or
// * we should quit.
//
// If we should use a new file, or should quit,
// then m_last_reason will tell us why consider
// thought so, and in the case of a new file,
// get_current_file_name() will tell us the new
// capture file name to use.
//
cycle_writer::conclusion consider(sinsp_evt* evt);
//
// The yields the current file name
// based on the input parameters and
// what has been past into consider.
//
string get_current_file_name();
// Last reason for a new file
string m_last_reason;
private:
//
// This will yield a new file if
// needed or conclude that we need
// to exit.
//
cycle_writer::conclusion next_file();
//
// These are the variables that are set
// to specify how the engine will work.
//
// Use the setup() function to set them up.
//
// values <= 0 mean don't use the feature.
//
// The base file name to write to
string m_base_file_name; // = ""
// Number of bytes before rolling over
int64_t m_rollover_mb; // = 0
// Time in seconds between captures
int m_duration_seconds; // = 0
// Total number of allowed captures
int m_file_limit; // = 0
// Event division: every how many event
// should I split the file?
unsigned long m_event_limit; // = 0L
private:
// Last time of a capture
time_t m_last_time;
// Total number of files written
int m_file_count_total;
// Current index
int m_file_index;
//
// This is the 0-left padded format
// for creating file names. Since
// we don't know what's what at first
// we just leave this hanging.
//
char m_limit_format[6];
// The last file name that
// was created (mostly for debugging)
string m_last_file_name;
//
// This is toggled to true the
// first time consider is run ...
// it will lock the setup() from
// being further run
//
bool m_first_consider; // = false
// number of events
unsigned long m_event_count; // = 0L
scap_dumper_t** m_dumper;
bool live;
// Used when ciclewriting on time with specified
// name format for deleting "out-of-range" files
string *m_past_names;
};
|
