Add IgnorePreviousMessages option to imjournal.

This option specifies whether imjournal should ignore messages
that are currently in journal. This option is only used when there
is no StateFile to avoid message loss.

	modified:   doc/imjournal.html
	modified:   plugins/imjournal/imjournal.c

Conflicts:
	doc/imjournal.html
	plugins/imjournal/imjournal.c

2 files changed, 41 insertions, 9 deletions

diff --git a/doc/imjournal.html b/doc/imjournal.html
index 1e82f7f1..1375745f 100644
--- a/doc/imjournal.html
+++ b/doc/imjournal.html
@@ -63,6 +63,10 @@ with the journal database - information current as of June 2013).
 Specifies the maximum number of messages that can be emitted within the
 ratelimit.interval interval. For futher information, see description there.
 
+<li><b>IgnorePreviousMessages</b> [<b>off</b>/on]<br>
+This option specifies whether imjournal should ignore messages currently in
+journal and read only new messages. This option is only used when there is
+no StateFile to avoid message loss.
 </ul>
 
 <b>Caveats/Known Bugs:</b>
@@ -91,14 +95,16 @@ action(type="omfile" file="/var/log/ceelog" template="CEETemplate")
 
 <p><b>Legacy Configuration Directives</b>:</p>
 <ul>
-<li>$imjournalPersistStateInterval &lt;Delimiter&gt;<br>
+<li><b>$imjournalPersistStateInterval</b> &lt;Delimiter&gt;<br>
 Equivalent to: ratelimit.PersistStateInterval</li>
-<li>$imjournalStateFile &lt;Delimiter&gt;<br>
+<li><b>$imjournalStateFile</b> &lt;Delimiter&gt;<br>
 Equivalent to: ratelimit.StateFile</li>
-<li>$imjournalRatelimitInterval &lt;Delimiter&gt;<br>
+<li><b>$imjournalRatelimitInterval</b> &lt;Delimiter&gt;<br>
 Equivalent to: ratelimit.interval</li>
-<li>$imjournalRatelimitBurst &lt;Delimiter&gt;<br>
+<li><b>$imjournalRatelimitBurst</b> &lt;Delimiter&gt;<br>
 Equivalent to: ratelimit.burst</li>
+<li><strong>$ImjournalIgnorePreviousMessages</strong> [<b>off</b>/on]<br>
+Equivalent to: ignorePreviousMessages</li>
 </ul>
 
 </body>
diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
index 74ef7115..7f6c31d6 100755
--- a/plugins/imjournal/imjournal.c
+++ b/plugins/imjournal/imjournal.c
@@ -67,6 +67,7 @@ static struct configSettings_s {
 	int iPersistStateInterval;
 	int ratelimitInterval;
 	int ratelimitBurst;
+	int bIgnorePrevious;
 } cs;
 
 /* module-global parameters */
@@ -74,7 +75,8 @@ static struct cnfparamdescr modpdescr[] = {
 	{ "statefile", eCmdHdlrGetWord, 0 },
 	{ "ratelimit.interval", eCmdHdlrInt, 0 },
 	{ "ratelimit.burst", eCmdHdlrInt, 0 },
-	{ "persiststateinterval", eCmdHdlrInt, 0 }
+	{ "persiststateinterval", eCmdHdlrInt, 0 },
+	{ "ignorepreviousmessages", eCmdHdlrBinary, 0 }
 };
 static struct cnfparamblk modpblk =
 	{ CNFPARAMBLK_VERSION,
@@ -253,9 +255,8 @@ readjournal() {
 
 		/* ... but we know better than to trust the specs */
 		if (equal_sign == NULL) {
-			errmsg.LogError(0, RS_RET_ERR,"SD_JOURNAL_FOREACH_DATA()"
-				" returned a malformed field (has no '='): '%s'",
-				(char*)get);
+			errmsg.LogError(0, RS_RET_ERR, "SD_JOURNAL_FOREACH_DATA()"
+				"returned a malformed field (has no '='): '%s'", get);
 			continue; /* skip the entry */
 		}
 
@@ -484,7 +485,28 @@ loadJournalState()
 			errmsg.LogError(0, RS_RET_FOPEN_FAILURE, "imjournal: "
 					"open on state file `%s' failed\n", cs.stateFile);
 		}
-	}
+	} else {
+		/* when IgnorePrevious, seek to the end of journal */
+		if (cs.bIgnorePrevious) {
+			if (sd_journal_seek_tail(j) < 0) {
+				char errStr[256];
+
+				rs_strerror_r(errno, errStr, sizeof(errStr));
+				errmsg.LogError(0, RS_RET_ERR,
+					"sd_journal_seek_tail() failed: '%s'", errStr);
+				ABORT_FINALIZE(RS_RET_ERR);
+			}
+
+			if (sd_journal_previous(j) < 0) {
+				char errStr[256];
+
+				rs_strerror_r(errno, errStr, sizeof(errStr));
+				errmsg.LogError(0, RS_RET_ERR,
+					"sd_journal_previous() failed: '%s'", errStr);
+				ABORT_FINALIZE(RS_RET_ERR);
+			}
+		}
+	} 
 
 finalize_it:
 	RETiRet;
@@ -630,6 +652,8 @@ CODESTARTsetModCnf
 			cs.ratelimitBurst = (int) pvals[i].val.d.n;
 		} else if(!strcmp(modpblk.descr[i].name, "ratelimit.interval")) {
 			cs.ratelimitInterval = (int) pvals[i].val.d.n;
+		} else if (!strcmp(modpblk.descr[i].name, "ignorepreviousmessages")) {
+			cs.bIgnorePrevious = (int) pvals[i].val.d.n; 
 		} else {
 			dbgprintf("imjournal: program error, non-handled "
 				"param '%s' in beginCnfLoad\n", modpblk.descr[i].name);
@@ -681,6 +705,8 @@ CODEmodInit_QueryRegCFSLineHdlr
 		NULL, &cs.ratelimitBurst, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"imjournalstatefile", 0, eCmdHdlrGetWord,
 		NULL, &cs.stateFile, STD_LOADABLE_MODULE_ID));
+	CHKiRet(omsdRegCFSLineHdlr((uchar *)"imjournalignorepreviousmessages", 0, eCmdHdlrBinary,
+		NULL, &cs.bIgnorePrevious, STD_LOADABLE_MODULE_ID)); 
 
 
 ENDmodInit