.\" Copyright (c) 2004 Andrey Simonenko .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .\" @(#)$Id: ipa_sdb.5,v 1.2 2006/03/21 20:24:43 simon Exp $ .\" .TH IPA_SDB 5 "April 12, 2004" .SH NAME ipa_sdb\ \-\ database format for ipa_db_sdb(8) and ipa_st_sdb(8) .SH SYNOPSIS #include .SH DATABASE FORMAT All structures needed for direct reading information from the database are available in the \fIipa_sdb.h\fP C-header file. .PP The \fIipa_sdb.h\fP file has macros for packing structures, which are determined by the configure script during installation, if you decide to use another compiler, than the compiler, which configure script used, then check this file and redefine these macros. .PP By default main database directory is \fI/var/ipa_sdb\fP (the value of the IPA_SDB_DB_DIR macro variable), but since it can be changed, then let's call it . .PP The ipa_db_sdb(8) and ipa_st_sdb(8) modules do not expect that any file or directory they currently use can be removed, renamed or modified by another process. .PP The number of the version of the database format is stored in the /\fIdb\ version\fP file (the value of the IPA_SDB_VERSION_FILE macro variable, the file name has one whitespace character). There is the IPA_SDB_FORMAT_VERSION macro variable, which is equal to the number of the version of the database format. .PP Statistics for arbitrary rule is stored in the / directory. There are files with yyyymm like names in this directory, which contain statistics per year/month. .PP Each /yyyymm file has records with the following format (the structure is usually packed): .PP .nf struct ipa_sdb_rule_record { uint8_t mday; uint8_t h1; uint8_t m1; uint8_t s1; uint8_t h2; uint8_t m2; uint8_t s2; uint32_t c_high; uint32_t c_low; }; .fi .PP \fImday\fP is a day of a month, \fIh1\fP, \fIm1\fP and \fIs1\fP is time when a record was added to the database, \fIh2\fP, \fIm2\fP and \fIs2\fP is time when a record was updated last time. \fIc_high\fP and \fIc_low\fP are high 32-bit part and low 32-bit part of the counter, each of these parts is represented in network byte order. Since a new record for any new day is always appended, then it is enough to have only the \fImday\fP field here. .PP If the //\fIinfo\fP file is present (the value of the IPA_SDB_INFO_FILE macro variable), then it contains description of the rule. .PP If a rule has limits then there is the //\fIlimits\fP/ directory (the value of the IPA_SDB_LIMITS_DIR macro variable) where statistics for limits are stored. Statistics for each limit is stored in the //\fIlimits\fP/ directory. There are files with yyyymm like names in this directory, which contain statistics per year/month. Here year/month means year and month when a limit was started (see below \fIstart\fP field). .PP Each /yyyymm file has records with the following format (the structures are usually packed): .PP .nf struct ipa_sdb_date_struct { uint16_t year; uint8_t mon; uint8_t mday; uint8_t hour; uint8_t min; uint8_t sec; }; typedef struct ipa_sdb_date_struct ipa_sdb_date; #define IPA_SDB_DATE_START_SET 0x01 #define IPA_SDB_DATE_RESTART_SET 0x02 #define IPA_SDB_DATE_RESTART_EXEC_SET 0x04 #define IPA_SDB_DATE_REACH_SET 0x08 #define IPA_SDB_DATE_REACH_EXEC_SET 0x10 #define IPA_SDB_DATE_EXPIRE_SET 0x20 #define IPA_SDB_DATE_EXPIRE_EXEC_SET 0x40 #define IPA_SDB_DATE_UPDATED_SET 0x80 struct ipa_sdb_limit_record { uint8_t set; ipa_sdb_date start; ipa_sdb_date restart; ipa_sdb_date restart_exec; ipa_sdb_date reach; ipa_sdb_date reach_exec; ipa_sdb_date expire; ipa_sdb_date expire_exec; uint32_t l_high; uint32_t l_low; ipa_sdb_date updated; uint32_t c_high; uint32_t c_low; }; .fi .PP IPA_SDB_DATE_xxx_SET bits in the \fIset\fP field determine which of fields with \fIipa_sdb_data\fP type have actual data. \fIstart\fP is a date when a limit was started, \fIrestart\fP is a date when a limit will be restarted, \fIrestart_exec\fP is a date when commands for restarted limit were run, \fIreach\fP is a date when a limit was reached, \fIreach_exec\fP is a date when commands for reached limit were run, \fIexpire\fP is a date when a limit will be expired, \fIexpire_exec\fP is a date when commands for expired limit were run and \fIupdated\fP is a date when a limit was updated last time. .PP The \fIyear\fP field in the \fIipa_sdb_date\fP structure is represented in network byte order. .PP \fIl_high\fP and \fIl_low\fP represent value of the limit, \fIc_high\fP and \fIc_low\fP represent value of the limit's counter. These fields have the same format as \fIc_high\fP and \fIc_low\fP fields in the \fIipa_sdb_rule_record\fP structure. .PP If the //\fIlimits\fP//\fIinfo\fP file is present (the value of the IPA_SDB_INFO_FILE macro variable), then it contains description of the limit. .PP If a rule has thresholds then there is the //\fIthresholds\fP/ directory (the value of the IPA_SDB_THRESHOLDS_DIR macro variable) where statistics for thresholds are stored. Statistics for each threshold is stored in the //\fIthresholds\fP/ directory. Each threshold's directory contains the \fIstate\fP file (the value of the IPA_SDB_THRESHOLD_STATE macro variable). This file contains current state for the threshold (the structure is usually packed): .PP .nf struct ipa_sdb_threshold_record { uint32_t t_high; uint32_t t_low; uint32_t c_high; uint32_t c_low; ipa_sdb_date tm_from; ipa_sdb_date tm_updated; }; .fi .PP \fIt_high\fP and \fIt_low\fP represent value of the threshold, \fIc_high\fP and \fIc_low\fP represent value of the threshold's counter. These fields have the same format as \fIc_high\fP and \fIc_low\fP fields in the \fIipa_sdb_rule_record\fP structure. .PP \fItm_from\fP and \fItm_updated\fP are two timestamps for the threshold. .PP If the //\fIthresholds\fP//\fIinfo\fP file is present (the value of the IPA_SDB_INFO_FILE macro variable), then it contains description of the threshold. .SH SEE ALSO ipa_db_sdb(8), ipa_st_sdb(8), ipa_sdb_dump(8) .SH AUTHOR Andrey\ Simonenko\ .SH BUGS If you find any, please send email me.