inliniac/suricata — pull request #793 by ken-tilera (2014-01-23 16:50:13+00:00)
Title: Add ability to log Alerts over PCIe from TILEncore card to Host

These changes enable sending fastlog alerts from Suricata running on a TILEncore-Gx PCIe card, over PCIe to an application running on the host x86 systems that writes the alerts to a file on the host system. This is faster than the default method where Suricata on the TILEncore-Gx PCIe writes the alerts to a file in the TILEncore-Gx's Linux file system, which is cross mounted using FUSE back to the host's file system. It is faster because PCIe logging is done directly from User Space on Tile Linux to User Space on the host Linux, thus avoiding system calls.

To cause PCIe logging to be done from Suricata, the filetype of fast log in suricata.yaml is set to "pcie". This then requires running tile_pci_logd on the host to receive the alerts. building tile_pcie_logd is enabled by the configure option: "--enable-pcie-logging"

The changes also reduce the amount of time the file mutex is held for fast log alerts by moving the printf() call to generate the alert out of the critical section by using snprintf() to generate the alert string before acquiring the file lock and then calling fwrite().

Passes regression tests:
https://buildbot.suricata-ids.org/builders/ken-tilera/builds/97
https://buildbot.suricata-ids.org/builders/ken-tilera-pcap/builds/30