在看snort源碼的時候,經常看到調用DEBUG_WRAP函數輸出的debug信息。研究了一下怎麼打開這個debug開關,以下是具體的步驟
1. 在configure 選項中添加--enable-debug-msgs 和--enable-debug ,這個打開了宏DEBUG_MSGS
2.定義環境變量SNORT_DEBUG和SNORT_PP_DEBUG, debug_level = $SNORT_DEBUG | ($SNORT_PP_DEBUG << 32)
爲了使環境變量對某個用戶生效,可以在~/.bashrc裏面添加 ,如 export SNORT_DEBUG=0x00000200
#define DEBUG_CONFIGRULES 0x0000000000000200LL
DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"[*] Processing keyword: %s\n", index););
void DebugMessageFunc(uint64_t level, const char *fmt, ...)
{
va_list ap;
<span style="color:#ff6666;">if (!(level & GetDebugLevel()))</span>
return;
va_start(ap, fmt);
if ((snort_conf != NULL) && (ScDaemonMode() || ScLogSyslog()))
{
char buf[STD_BUF];
int buf_len = sizeof(buf);
char *buf_ptr = buf;
buf[buf_len - 1] = '\0';
/* filename and line number information */
if (DebugMessageFile != NULL)
{
snprintf(buf, buf_len - 1, "%s:%d: ",
DebugMessageFile, DebugMessageLine);
buf_ptr += strlen(buf);
buf_len -= strlen(buf);
}
vsnprintf(buf_ptr, buf_len - 1, fmt, ap);
syslog(LOG_DAEMON | LOG_DEBUG, "%s", buf);
}
else
{
if (DebugMessageFile != NULL)
printf("%s:%d: ", DebugMessageFile, DebugMessageLine);
vprintf(fmt, ap);
}
va_end(ap);
}
uint64_t <span style="color:#ff6666;">GetDebugLevel</span>(void)
{
static int debug_init = 0;
static uint64_t debug_level = 0;
const char* key;
if ( debug_init )
return debug_level;
key = getenv(DEBUG_PP_VAR);
if ( key )
debug_level = strtoul(key, NULL, 0);
debug_level <<= 32;
key = getenv(DEBUG_VARIABLE);
if ( key )
debug_level |= strtoul(key, NULL, 0);
debug_init = 1;
return debug_level;
}