[Prelude Hybrid IDS] #176: Reading IDMEF Messages from the Manager

#176: Reading IDMEF Messages from the Manager
-------------------------------+--------------------------------------------
 Reporter:  [email protected]  |       Owner:  yoann            
     Type:  defect             |      Status:  new              
 Priority:  normal             |   Milestone:  Libprelude 0.9.11
Component:  libprelude         |     Version:  0.9              
 Severity:  normal             |    Keywords:                   
-------------------------------+--------------------------------------------
 Hello,

 I'm writing a small sensor to print IDMEF messages to the screen but I was
 wondering how to go about writing the program to do so.

 Here's the code I got so far
 ----------------CODE-------------
 int main(int argc, char **argv) {

         int ret;

         ret = prelude_init(&argc, argv);
         if ( ret < 0 ) {
                         prelude_perror(ret, "unable to initialize the
 prelude library");
                         return -1;
         }

         prelude_client_t *client;

         ret = prelude_client_new(&client, "AcSP");
         if ( ! client ) {
                         prelude_perror(ret, "Unable to create a prelude
 client object");
                         return -1;
         }

         ret = prelude_client_start(client);
         if ( ret < 0 ) {
                    prelude_perror(ret, "Unable to start prelude client");
                    return -1;
         }

         ret = prelude_client_set_flags(client,
 PRELUDE_CLIENT_FLAGS_ASYNC_SEND|PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
         if ( ret < 0 ) {
                    fprintf(stderr, "Unable to set asynchronous send and
 timer.\n");
                    return -1;
         }

         prelude_msg_t *pmsg;
         idmef_message_t *message;
         prelude_io_t *pio;

     do
         {
         sleep(1);

                 ret = prelude_io_new(&pio);
                 if ( ret < 0 )
                                 return ret;

                 ret = prelude_msg_new(&pmsg, 10, 32, 1, 0);
                 if ( ret < 0 )
                                 return ret;

                 ret = prelude_msg_read(&pmsg, pio);
                 if ( ret < 0 )
                                 return ret;


                 ret = idmef_message_new(&message);
                 if ( ret < 0 )
                                 return ret;
 /*
                 ret = idmef_message_read(message, pmsg);
                 if ( ret < 0 )
                                 return ret;
 */
                 prelude_timer_wake_up();

         } while ( ret > 0 );

         prelude_client_destroy(client,
 PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);

         return 0;
 }
 -------------------END CODE--------------

 But I'm wondering what I'm missing when reading from pio coz after the
 sensor registers I get a Seg Fault.

 An example of how to do so would be most welcome!

 Thanks in advance,

 Samer

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/176>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel