void Liblognorm_Load(char *infile) { SaganNormalizeLiblognorm = malloc(sizeof(struct _SaganNormalizeLiblognorm)); if ( SaganNormalizeLiblognorm == NULL ) { Sagan_Log(ERROR, "[%s, line %d] Failed to allocate memory for SaganNormalizeLiblognorm. Abort!", __FILE__, __LINE__); } memset(SaganNormalizeLiblognorm, 0, sizeof(_SaganNormalizeLiblognorm)); if((ctx = ln_initCtx()) == NULL) { Sagan_Log(ERROR, "[%s, line %d] Cannot initialize liblognorm context.", __FILE__, __LINE__); } Sagan_Log(NORMAL, "Loading %s for normalization.", infile); /* Remember - On reload, file access will be by the "sagan" user! */ if (stat(infile, &liblognorm_fileinfo)) { Sagan_Log(ERROR, "[%s, line %d] Error accessing '%s'. Abort.", __FILE__, __LINE__, infile); } ln_loadSamples(ctx, infile); }
/* to be called to build the libee part of the instance ONCE ALL PARAMETERS ARE CORRECT * (and set within pData!). */ static rsRetVal buildInstance(instanceData *pData) { DEFiRet; if((pData->ctxee = ee_initCtx()) == NULL) { errmsg.LogError(0, RS_RET_ERR_LIBEE_INIT, "error: could not initialize libee " "ctx, cannot activate action"); ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT); } if((pData->ctxln = ln_initCtx()) == NULL) { errmsg.LogError(0, RS_RET_ERR_LIBLOGNORM_INIT, "error: could not initialize " "liblognorm ctx, cannot activate action"); ee_exitCtx(pData->ctxee); ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_INIT); } ln_setEECtx(pData->ctxln, pData->ctxee); if(ln_loadSamples(pData->ctxln, (char*) pData->rulebase) != 0) { errmsg.LogError(0, RS_RET_NO_RULEBASE, "error: normalization rulebase '%s' " "could not be loaded cannot activate action", cs.rulebase); ee_exitCtx(pData->ctxee); ln_exitCtx(pData->ctxln); ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_SAMPDB_LOAD); } finalize_it: RETiRet; }
ln_ctx ln_v1_inherittedCtx(ln_ctx parent) { ln_ctx child = ln_initCtx(); if (child != NULL) { child->allowRegex = parent->allowRegex; child->dbgCB = parent->dbgCB; child->dbgCookie = parent->dbgCookie; child->version = parent->version; child->ptree = ln_newPTree(child, NULL); } return child; }
int main() { const char* str = "foo says hello!"; json_object *obj, *from, *msg; obj = from = msg = NULL; ln_ctx ctx = ln_initCtx(); int ret = 1; ln_v1_loadSample(ctx, "rule=:%from:word% says %msg:word%"); if (ln_v1_normalize(ctx, str, strlen(str), &obj) == 0) { json_object_object_get_ex(obj, "from", &from); json_object_object_get_ex(obj, "msg", &msg); ret = strcmp(json_object_get_string(from), "foo") || strcmp(json_object_get_string(msg), "hello!"); } if (obj != NULL) json_object_put(obj); ln_exitCtx(ctx); return ret; }