sensor.c API rework
#2 Updated by Yoann VANDOORSELAERE over 18 years ago
This is what we came up to after some discussion, comment are greatly appreciated, flames will goes to /dev/null.
1. Configuration files changes
/etc/prelude-sensors/ -> /etc/prelude/ /etc/sensor-name/ -> /etc/prelude/sensor-name/ /var/spool/prelude-sensors/ -> /var/spool/prelude/ /etc/prelude-sensors/sensors-default.conf -> splitted in two part: /etc/prelude/defaults/global.conf included by everyone (agents, sensors, managers). /etc/prelude/defaults/manager-client.conf included by agents and sensors.
- Some definitions:
- sensors: monitoring application sending events to a manager.
- managers: application receiving sensors events, and possibly relaying theses events to others manager.
- agents: application connected to a manager, issuing specific task depending on the manager input (correlation agents, counter measure agent).
2. API renaming
- Need to encapsulate sensor.c API in an object. - This object is used by agents/managers/sensors, and the behavior vary depending on the type - prelude_client_t seem to encapsulate all of the above. - conflict with existing prelude_client_t connection API, which should be renamed