dev_notes.txt (snort3-3.1.29.0) | : | dev_notes.txt (snort3-3.1.30.0) | ||
---|---|---|---|---|
skipping to change at line 40 | skipping to change at line 40 | |||
Each class acts a separate module for gathering the different forms of | Each class acts a separate module for gathering the different forms of | |||
statistics. The PerfTracker classes pass their data into one of formatter | statistics. The PerfTracker classes pass their data into one of formatter | |||
classes, which in turn format the data for output to console or to disk. | classes, which in turn format the data for output to console or to disk. | |||
Currently output formats are: | Currently output formats are: | |||
1. Human-readable text | 1. Human-readable text | |||
2. CSV | 2. CSV | |||
3. Flatbuffers (if the library is available at build) | 3. JSON | |||
==== Flatbuffers Parsing | ||||
While a tool has been included to parse the file format used, it may be | ||||
desired to build analysis tools that deal with the files directly. This can | ||||
be accomplished in a few ways; either the records can be split and passed to | ||||
flatc along with the included schema, or the schema can be parsed using the | ||||
Flatbuffers reflection API and used to read the data within the records. | ||||
The format for the files is as follows: | ||||
===== File Layout | ===== File Layout | |||
[options="header"] | [options="header"] | |||
|============================================================================ | |============================================================================ | |||
|Section |Description | |Section |Description | |||
|File Header |File ID and schema for parsing. This appears once at the start. | |File Header |File ID and schema for parsing. This appears once at the start. | |||
|Records |This is a stream of records. There may be an unlimited number. | |Records |This is a stream of records. There may be an unlimited number. | |||
|============================================================================ | |============================================================================ | |||
End of changes. 1 change blocks. | ||||
10 lines changed or deleted | 1 lines changed or added |