Hi, On Tuesday, 2008 March 25 at 11:03:33 +0100, Pablo Neira Ayuso wrote: > Eric Leblond wrote: > > Hello, > > > > This patchset starts with some cleaning: > > - Add hook to list of fields in database for packet logging. > > - Introduce RAWSTR type to avoid confusion in future developement. > > - Fix indentation in ulogd_inppkt_NFLOG.c > > > > Latest patches introduce a modification of plugin behaviour. It was not > > possible with existing code to reuse a plugin instance. For example, it > > is not possible to do : > > stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU > > stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu2:LOGEMU > > I'd appreciate a patch with a more realistic example that I can apply to > SVN. I've tried to add an example in the example configuration file but I've found that some matching examples seems already available. Follow an excerpt of ulogd.conf.in (taken from my last patchset): # this is a stack for NFLOG packet-based logging to PCAP #stack=log1:NFLOG,base1:BASE,pcap1:PCAP # this is a stack for logging packet to MySQL #stack=log1:NFLOG,base1:BASE,ifi1:IFINDEX,ip2bin1:IP2BIN,mac2str1:MAC2STR,mysql1:MYSQL Furthermore, I think the behaviour obtained with that patchset is what users are waiting from ulogd2. IMHO, it is not necessary to add long explanation in the configuration file. But, just to be sure it is written somewhere, I've added a more detailled explanation of multiple usage of an instance in my ulogd configuration page: http://software.inl.fr//trac/wiki/ulogd2/user BR, -- Eric Leblond INL: http://www.inl.fr/ NuFW: http://www.nufw.org/
Attachment:
signature.asc
Description: Digital signature
