Re: Store the same analyzer in different alerts

Hi Victor,

Le mardi 26 juin 2007 à 16:27 +0200, Victor Stinner a écrit :
> After digging Prelude source code, I understood why my alerts sometimes lost 
> their analyzer(1): it's not possible to use the same analyzer in two 
> different alerts.
> 
> I mean different alerts existing at the same moment: I use alert template for 
> faster alert creation and then clone them to send messages. I create all 
> templates on startup and destroy them when I leave my program.
> 
> My buggy code was:

[...]

> So on first call, analyzer is *connected* to first alert. On second call, 
> analyzer is detached with prelude_list_del_init() call and then connected to 
> second alert.
> 
> Fixed version is:

[...]

> I don't know if it could be called a bug. It sounds like a feature, but for 
> end user (prelude sensor developers, like me) it's hard to understand.
> 
> Solution:
> - Store reference to the analyzer in the alert, and not directly the analyzer 
> <= it's not a good idea to change this sensitive code

We could use dynamically allocated container, containing the list
members and a direct reference to the IDMEF object (here the Analyzer). 

This is something that probably could be implemented without breaking
libprelude API, although it could have other unforeseen consequences. 

I will think about this issue.

> - or Use my workaround to avoid the behaviour
> - or Write more API documentation
> - or Write howto documentation (write a sensor)
> - or Another idea?

Updating the API documentation to explain the current behavior would be
a good idea. We will then see if using a "container" system would be
more suitable.

Thanks for the feedback!

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel