1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
NatFork's child process starts a producer (e.g., ConntrackProducer) and a
consumer (ConnectionsConsumer).
The producer writes information to a Storage, and the consumer reads
information from the Storage. The Storage contains a queue and is created by
NatFork::childProcess. The Storage object is passed as reference to the
ConnectionsConsumer and to the producer.
Messages are received by the ConnectionsConsumer.
The ConnectionConsumer::run member receives records from the storage, and
passes them on to the record's protocol handling object (ICMP, UDP, or
TCP). These objects' constructors receive a reference to the 'ostream stdMsg'
and to 'RotatingStream d_logDataStream'.
These protocol handling objects implement a member 'process', receiving a
unique_ptr to the received record. The record may indicate incoming (IN,
inDev) information, outgoing (OUT, outDev) information, a new (NEW, insert)
connection, or an ending (DESTROY, destroy) connection.
The function inDev..destroy are virtual members overridden by the
protocol-specific members. The TCP, UDP and ICMP objects handling the
connections are derived from IPbase. IPbase handles the logging.
IPbase::logConnection inserts the logged information into d_stdMsg, and
(optionally) CSV-data into d_logDataStream, received by its
constructor. d_logDataStream is a RotatingStream, which can be rotated
according to the 'log-rotate' option specification.
d_stdMsg is initialized by NatFork::setupStdMsg. If option 'log-file' was
specified then the specified file is rotated if 'log-rotate' is also
specified. E.g., when calling natlog with options '--log=/tmp/nat.log
--log-rotate=5m5' then after 25 minutes the following log files are available
/tmp/nat.log, /tmp/nat.log.1, /tmp/nat.log.2, /tmp/nat.log.3, /tmp/nat.log.4,
/tmp/nat.log.5.
|
