Having hostname in EVENT_FLOW_END json output?
fateme81 opened this issue · comments
fateme81 commented
we have field host_server_name as a field of EVENT_FLOW_DETECTED log. how can we bring it in EVENT_FLOW_END ??
Toni commented
You need to store the host server name in the current flow.
For the C API: You need to reserve some user flow memory during socket init. In the JSON callback you may then access your memory via nDPIsrvd's flow struct.
For the Python API: You may use the current flow in the JSON callback and add the information you'll need. This information will be available as long as the flow does not end or time out.