From b9d3cdceabf91bc28f8f6d31cfe9332724e37bbf Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 1 Dec 2010 08:46:20 +0100 Subject: milestone: added mmnormalize (compiles, but untested) --- plugins/mmnormalize/mmnormalize.c | 261 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 261 insertions(+) create mode 100644 plugins/mmnormalize/mmnormalize.c (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c new file mode 100644 index 00000000..6c0293cf --- /dev/null +++ b/plugins/mmnormalize/mmnormalize.c @@ -0,0 +1,261 @@ +/* mmnormalize.c + * This is a message modification module. It normalizes the input message with + * the help of liblognorm. The messages EE event structure is updated. + * + * NOTE: read comments in module-template.h for details on the calling interface! + * + * File begun on 2010-01-01 by RGerhards + * + * Copyright 2010 Rainer Gerhards and Adiscon GmbH. + * + * This file is part of rsyslog. + * + * Rsyslog is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Rsyslog is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Rsyslog. If not, see . + * + * A copy of the GPL can be found in the file "COPYING" in this distribution. + */ +#include "config.h" +#include "rsyslog.h" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "conf.h" +#include "syslogd-types.h" +#include "template.h" +#include "module-template.h" +#include "errmsg.h" +#include "cfsysline.h" +#include "dirty.h" + +MODULE_TYPE_OUTPUT + +static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal); + +/* static data */ +DEFobjCurrIf(errmsg); + +/* internal structures + */ +DEF_OMOD_STATIC_DATA + +typedef struct _instanceData { + sbool bUseRawMsg; /**< use %rawmsg% instead of %msg% */ + ln_ctx ctxln; /**< context to be used for liblognorm */ + ee_ctx ctxee; /**< context to be used for libee */ +} instanceData; + +typedef struct configSettings_s { + uchar *sampdb; /**< name of sample db to use */ + sbool bUseRawMsg; /**< use %rawmsg% instead of %msg% */ +} configSettings_t; + +SCOPING_SUPPORT; /* must be set AFTER configSettings_t is defined */ + +BEGINinitConfVars /* (re)set config variables to default values */ +CODESTARTinitConfVars + resetConfigVariables(NULL, NULL); +ENDinitConfVars + + +BEGINcreateInstance +CODESTARTcreateInstance +ENDcreateInstance + + +BEGINisCompatibleWithFeature +CODESTARTisCompatibleWithFeature +ENDisCompatibleWithFeature + + +BEGINfreeInstance +CODESTARTfreeInstance + ee_exitCtx(pData->ctxee); + ln_exitCtx(pData->ctxln); +ENDfreeInstance + + +BEGINdbgPrintInstInfo +CODESTARTdbgPrintInstInfo + dbgprintf("mmnormalize\n"); +ENDdbgPrintInstInfo + + +BEGINtryResume +CODESTARTtryResume +ENDtryResume + +BEGINdoAction + msg_t *pMsg; + es_str_t *str; + uchar *buf; + int len; + int r; +CODESTARTdoAction + pMsg = (msg_t*) ppString[0]; + /* note that we can performance-optimize the interface, but this also + * requires changes to the libraries. For now, we accept message + * duplication. -- rgerhards, 2010-12-01 + */ + if(pData->bUseRawMsg) { + getRawMsg(pMsg, &buf, &len); + } else { + buf = getMSG(pMsg); + len = getMSGLen(pMsg); + } + str = es_newStrFromCStr((char*)buf, len); + r = ln_normalize(pData->ctxln, str, &pMsg->event); + if(r != 0) { + DBGPRINTF("error %d during ln_normalize\n", r); + } + es_deleteStr(str); +ENDdoAction + + +BEGINparseSelectorAct +CODESTARTparseSelectorAct +CODE_STD_STRING_REQUESTparseSelectorAct(1) + /* first check if this config line is actually for us */ + if(strncmp((char*) p, ":mmnormalize:", sizeof(":mmnormalize:") - 1)) { + ABORT_FINALIZE(RS_RET_CONFLINE_UNPROCESSED); + } + + if(cs.sampdb == NULL) { + errmsg.LogError(0, RS_RET_NO_RULESET, "error: no sample database was specified, use " + "$MMNormalizeSampleDB directive first!"); + ABORT_FINALIZE(RS_RET_NO_RULESET); + } + + /* ok, if we reach this point, we have something for us */ + p += sizeof(":mmnormalize:") - 1; /* eat indicator sequence (-1 because of '\0'!) */ + CHKiRet(createInstance(&pData)); + + /* check if a non-standard template is to be applied */ + if(*(p-1) == ';') + --p; + /* we call the function below because we need to call it via our interface definition. However, + * the format specified (if any) is always ignored. + */ + CHKiRet(cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_TPL_AS_MSG, (uchar*) "RSYSLOG_FileFormat")); + + /* finally build the instance */ + if((pData->ctxee = ee_initCtx()) == NULL) { + errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize libee ctx, cannot " + "activate action"); + ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT); + } + + if((pData->ctxln = ln_initCtx()) == NULL) { + errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize liblognorm ctx, cannot " + "activate action"); + ee_exitCtx(pData->ctxee); + ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_INIT); + } + if(ln_loadSamples(pData->ctxln, (char*) cs.sampdb) != 0) { + errmsg.LogError(0, RS_RET_NO_RULESET, "error: sample db '%s' could not be loaded " + "cannot activate action", cs.sampdb); + ee_exitCtx(pData->ctxee); + ln_exitCtx(pData->ctxln); + ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_SAMPDB_LOAD); + } + pData->bUseRawMsg = cs.bUseRawMsg; + + /* all config vars auto-reset! */ + cs.bUseRawMsg = 0; + cs.sampdb = NULL; +CODE_STD_FINALIZERparseSelectorAct +ENDparseSelectorAct + + +BEGINmodExit +CODESTARTmodExit + objRelease(errmsg, CORE_COMPONENT); +ENDmodExit + + +BEGINqueryEtryPt +CODESTARTqueryEtryPt +CODEqueryEtryPt_STD_OMOD_QUERIES +ENDqueryEtryPt + + + +/* Reset config variables for this module to default values. + */ +static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal) +{ + DEFiRet; + cs.sampdb = NULL; + cs.bUseRawMsg = 0; + RETiRet; +} + +/* set the sampdb name */ +static rsRetVal +setSampDB(void __attribute__((unused)) *pVal, uchar *pszName) +{ + DEFiRet; + cs.sampdb = pszName; + pszName = NULL; + RETiRet; +} + +BEGINmodInit() + rsRetVal localRet; + rsRetVal (*pomsrGetSupportedTplOpts)(unsigned long *pOpts); + unsigned long opts; + int bMsgPassingSupported; +CODESTARTmodInit +SCOPINGmodInit + *ipIFVersProvided = CURR_MOD_IF_VERSION; + /* we only support the current interface specification */ +CODEmodInit_QueryRegCFSLineHdlr + /* check if the rsyslog core supports parameter passing code */ + bMsgPassingSupported = 0; + localRet = pHostQueryEtryPt((uchar*)"OMSRgetSupportedTplOpts", + &pomsrGetSupportedTplOpts); + if(localRet == RS_RET_OK) { + /* found entry point, so let's see if core supports msg passing */ + CHKiRet((*pomsrGetSupportedTplOpts)(&opts)); + if(opts & OMSR_TPL_AS_MSG) + bMsgPassingSupported = 1; + } else if(localRet != RS_RET_ENTRY_POINT_NOT_FOUND) { + ABORT_FINALIZE(localRet); /* Something else went wrong, not acceptable */ + } + + if(!bMsgPassingSupported) { + DBGPRINTF("mmnormalize: msg-passing is not supported by rsyslog core, " + "can not continue.\n"); + ABORT_FINALIZE(RS_RET_NO_MSG_PASSING); + } + + CHKiRet(objUse(errmsg, CORE_COMPONENT)); + + CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizesampledb", 0, eCmdHdlrGetWord, + setSampDB, NULL, STD_LOADABLE_MODULE_ID, eConfObjAction)); + CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizeuserawmsg", 0, eCmdHdlrInt, + NULL, &cs.bUseRawMsg, STD_LOADABLE_MODULE_ID, eConfObjAction)); + CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, + resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID, eConfObjAction)); +ENDmodInit + +/* vi:set ai: + */ -- cgit v1.2.3 From cbfa21f8230d211cc1dfc3284c8d4437b6c5ebc1 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 1 Dec 2010 09:37:13 +0100 Subject: mmnormalize loads & runs (basic testing done) --- plugins/mmnormalize/mmnormalize.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 6c0293cf..8da8f7eb 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -126,6 +126,17 @@ CODESTARTdoAction if(r != 0) { DBGPRINTF("error %d during ln_normalize\n", r); } + /***DEBUG***/ + { + dbgprintf("mmnormalize: event ptr now is %p\n", pMsg->event); + char *cstr; + es_emptyStr(str); + ee_fmtEventToJSON(pMsg->event, &str); + cstr = es_str2cstr(str, NULL); + dbgprintf("mmnormalize generated: %s\n", cstr); + free(cstr); + } + /***END DEBUG***/ es_deleteStr(str); ENDdoAction @@ -169,6 +180,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) ee_exitCtx(pData->ctxee); ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_INIT); } + ln_setEECtx(pData->ctxln, pData->ctxee); if(ln_loadSamples(pData->ctxln, (char*) cs.sampdb) != 0) { errmsg.LogError(0, RS_RET_NO_RULESET, "error: sample db '%s' could not be loaded " "cannot activate action", cs.sampdb); -- cgit v1.2.3 From 471f07f45a382c29f74e1c676bd081c3b304d7db Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 1 Dec 2010 10:19:50 +0100 Subject: milestone: template supports CEE output via %$!all-json% --- plugins/mmnormalize/mmnormalize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 8da8f7eb..d9d64687 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -126,7 +126,7 @@ CODESTARTdoAction if(r != 0) { DBGPRINTF("error %d during ln_normalize\n", r); } - /***DEBUG***/ + /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01 { dbgprintf("mmnormalize: event ptr now is %p\n", pMsg->event); char *cstr; -- cgit v1.2.3 From 48877c8ef41787d59a062ab07f5b6ee37eba7ce1 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 1 Dec 2010 17:28:36 +0100 Subject: milestone: added support for CEE-properties in property-based filters --- plugins/mmnormalize/mmnormalize.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index d9d64687..8c4efd81 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -126,18 +126,17 @@ CODESTARTdoAction if(r != 0) { DBGPRINTF("error %d during ln_normalize\n", r); } + es_deleteStr(str); /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01 { - dbgprintf("mmnormalize: event ptr now is %p\n", pMsg->event); char *cstr; - es_emptyStr(str); ee_fmtEventToJSON(pMsg->event, &str); cstr = es_str2cstr(str, NULL); dbgprintf("mmnormalize generated: %s\n", cstr); free(cstr); + es_deleteStr(str); } /***END DEBUG***/ - es_deleteStr(str); ENDdoAction @@ -192,6 +191,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) /* all config vars auto-reset! */ cs.bUseRawMsg = 0; + free(cs.sampdb); cs.sampdb = NULL; CODE_STD_FINALIZERparseSelectorAct ENDparseSelectorAct -- cgit v1.2.3 From 209ab60f85001fcb4763fd125de879a00bb1b87f Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 13 Apr 2011 14:21:18 +0200 Subject: added log classification capabilities (via mmnormalize & tags) --- plugins/mmnormalize/mmnormalize.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 8db4ad45..9c23afde 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -65,7 +65,7 @@ typedef struct _instanceData { } instanceData; typedef struct configSettings_s { - uchar *rulebase; /**< name of sample db to use */ + uchar *rulebase; /**< name of normalization rulebase to use */ sbool bUseRawMsg; /**< use %rawmsg% instead of %msg% */ } configSettings_t; @@ -150,7 +150,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) } if(cs.rulebase == NULL) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: no sample database was specified, use " + errmsg.LogError(0, RS_RET_NO_RULESET, "error: no normalization rulebase was specified, use " "$MMNormalizeSampleDB directive first!"); ABORT_FINALIZE(RS_RET_NO_RULESET); } @@ -182,7 +182,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) } ln_setEECtx(pData->ctxln, pData->ctxee); if(ln_loadSamples(pData->ctxln, (char*) cs.rulebase) != 0) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: sample db '%s' could not be loaded " + errmsg.LogError(0, RS_RET_NO_RULESET, "error: normalization rulebase '%s' could not be loaded " "cannot activate action", cs.rulebase); ee_exitCtx(pData->ctxee); ln_exitCtx(pData->ctxln); -- cgit v1.2.3 From e1c34e174139ad030ca1108ff9782b294909013c Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 19 Apr 2011 07:53:23 +0200 Subject: renamed conf.c to legacyconf.c to make room for new config system --- plugins/mmnormalize/mmnormalize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 9c23afde..9517ec09 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -38,7 +38,7 @@ #include #include #include -#include "conf.h" +#include "legacyconf.h" #include "syslogd-types.h" #include "template.h" #include "module-template.h" -- cgit v1.2.3 From bbe1f2688c4bd5cb1b66bb48af1ce5428d69c3b9 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 19 Apr 2011 08:24:25 +0200 Subject: renaming conf.* wasn't a good idea -- undoing too many dependencies, things get cluttered (and merging probably gets problematic). Now new config will be "conf2". --- plugins/mmnormalize/mmnormalize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 9517ec09..9c23afde 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -38,7 +38,7 @@ #include #include #include -#include "legacyconf.h" +#include "conf.h" #include "syslogd-types.h" #include "template.h" #include "module-template.h" -- cgit v1.2.3 From a7e3afb20b461f608f478e8fca15b02e67d6d9c3 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 20 Jul 2011 10:47:24 +0200 Subject: milestone: added module config names --- plugins/mmnormalize/mmnormalize.c | 1 + 1 file changed, 1 insertion(+) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 9c23afde..7679e788 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -48,6 +48,7 @@ MODULE_TYPE_OUTPUT MODULE_TYPE_NOKEEP +MODULE_CNFNAME("mmnormalize") static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal); -- cgit v1.2.3 From b38dd53e08258bc694f16373671be9c1c3deaa0c Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 19 Jan 2012 12:33:12 +0100 Subject: undoing v6.1 config scoping interface, part II (now finished) This concludes the removal of the new scoping interface, at least as far as pre v6-plugins are affected. Full code cleanup will happen in the v6.3 branch. --- plugins/mmnormalize/mmnormalize.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 9c23afde..adba0efe 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -263,11 +263,11 @@ CODEmodInit_QueryRegCFSLineHdlr CHKiRet(objUse(errmsg, CORE_COMPONENT)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizerulebase", 0, eCmdHdlrGetWord, - setRuleBase, NULL, STD_LOADABLE_MODULE_ID, eConfObjAction)); + setRuleBase, NULL, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizeuserawmsg", 0, eCmdHdlrInt, - NULL, &cs.bUseRawMsg, STD_LOADABLE_MODULE_ID, eConfObjAction)); + NULL, &cs.bUseRawMsg, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, - resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID, eConfObjAction)); + resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID)); ENDmodInit /* vi:set ai: -- cgit v1.2.3 From 535d6cf0b8fe2423eee3fd670bc1e944b231e827 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 19 Jan 2012 14:48:40 +0100 Subject: v6.1/2 scoping support removed from plugins --- plugins/mmnormalize/mmnormalize.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index fd898a3b..7b92d820 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -69,8 +69,7 @@ typedef struct configSettings_s { uchar *rulebase; /**< name of normalization rulebase to use */ sbool bUseRawMsg; /**< use %rawmsg% instead of %msg% */ } configSettings_t; - -SCOPING_SUPPORT; /* must be set AFTER configSettings_t is defined */ +static configSettings_t cs; BEGINinitConfVars /* (re)set config variables to default values */ CODESTARTinitConfVars @@ -238,7 +237,7 @@ BEGINmodInit() unsigned long opts; int bMsgPassingSupported; CODESTARTmodInit -SCOPINGmodInit +INITLegCnfVars *ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */ CODEmodInit_QueryRegCFSLineHdlr -- cgit v1.2.3 From 66ab2a70e5bcc9637dfec89c6134abe10b96dde8 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 15 Mar 2012 17:25:26 +0100 Subject: added message property parsesuccess to indicate status of higher level parser run added message property parsesuccess to indicate if the last run higher-level parser could successfully parse the message or not (see property replacer html doc for details) --- plugins/mmnormalize/mmnormalize.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 7b92d820..c5b290f4 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -126,6 +126,9 @@ CODESTARTdoAction r = ln_normalize(pData->ctxln, str, &pMsg->event); if(r != 0) { DBGPRINTF("error %d during ln_normalize\n", r); + MsgSetParseSuccess(pMsg, 0); + } else { + MsgSetParseSuccess(pMsg, 1); } es_deleteStr(str); /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01 -- cgit v1.2.3 From 3505de72636c9dd219ca586ff421a7847278998d Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Mon, 27 Aug 2012 16:00:04 +0200 Subject: mmnormalize: switched to new JSON system Warning: so far untested --- plugins/mmnormalize/mmnormalize.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index c5b290f4..bf0b9ce6 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -4,9 +4,12 @@ * * NOTE: read comments in module-template.h for details on the calling interface! * + * TODO: check if we can replace libee via JSON system - currently that part + * is pretty inefficient... rgerhards, 2012-08-27 + * * File begun on 2010-01-01 by RGerhards * - * Copyright 2010 Rainer Gerhards and Adiscon GmbH. + * Copyright 2010-2012 Rainer Gerhards and Adiscon GmbH. * * This file is part of rsyslog. * @@ -37,6 +40,7 @@ #include #include #include +#include #include #include "conf.h" #include "syslogd-types.h" @@ -108,8 +112,12 @@ BEGINdoAction msg_t *pMsg; es_str_t *str; uchar *buf; + char *cstrJSON; int len; int r; + struct ee_event *event = NULL; + struct json_tokener *tokener; + struct json_object *json; CODESTARTdoAction pMsg = (msg_t*) ppString[0]; /* note that we can performance-optimize the interface, but this also @@ -123,7 +131,7 @@ CODESTARTdoAction len = getMSGLen(pMsg); } str = es_newStrFromCStr((char*)buf, len); - r = ln_normalize(pData->ctxln, str, &pMsg->event); + r = ln_normalize(pData->ctxln, str, &event); if(r != 0) { DBGPRINTF("error %d during ln_normalize\n", r); MsgSetParseSuccess(pMsg, 0); @@ -131,16 +139,20 @@ CODESTARTdoAction MsgSetParseSuccess(pMsg, 1); } es_deleteStr(str); - /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01 - { - char *cstr; - ee_fmtEventToJSON(pMsg->event, &str); - cstr = es_str2cstr(str, NULL); - dbgprintf("mmnormalize generated: %s\n", cstr); - free(cstr); - es_deleteStr(str); - } - /***END DEBUG***/ + + /* reformat to our json data struct */ + // TODO: this is all extremly ineffcient! + ee_fmtEventToJSON(event, &str); + cstrJSON = es_str2cstr(str, NULL); + dbgprintf("mmnormalize generated: %s\n", cstrJSON); + + tokener = json_tokener_new(); + json = json_tokener_parse_ex(tokener, cstrJSON, strlen((char*)cstrJSON)); + json_tokener_free(tokener); + msgAddJSON(pMsg, (uchar*)"!", json); + + free(cstrJSON); + es_deleteStr(str); ENDdoAction -- cgit v1.2.3 From 19354af62c61e7b99832a8df5df3410295f11065 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 1 Nov 2012 18:12:26 +0100 Subject: mmnormalize: support for v6+ config interface added --- plugins/mmnormalize/mmnormalize.c | 174 +++++++++++++++++++++++++++++++------- 1 file changed, 145 insertions(+), 29 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index bf0b9ce6..9c7718b7 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -65,6 +65,7 @@ DEF_OMOD_STATIC_DATA typedef struct _instanceData { sbool bUseRawMsg; /**< use %rawmsg% instead of %msg% */ + uchar *rulebase; /**< name of rulebase to use */ ln_ctx ctxln; /**< context to be used for liblognorm */ ee_ctx ctxee; /**< context to be used for libee */ } instanceData; @@ -75,6 +76,58 @@ typedef struct configSettings_s { } configSettings_t; static configSettings_t cs; +/* tables for interfacing with the v6 config system */ +/* action (instance) parameters */ +static struct cnfparamdescr actpdescr[] = { + { "rulebase", eCmdHdlrGetWord, 1 }, + { "userawmsg", eCmdHdlrBinary, 0 } +}; +static struct cnfparamblk actpblk = + { CNFPARAMBLK_VERSION, + sizeof(actpdescr)/sizeof(struct cnfparamdescr), + actpdescr + }; + +struct modConfData_s { + rsconf_t *pConf; /* our overall config object */ +}; + +static modConfData_t *loadModConf = NULL;/* modConf ptr to use for the current load process */ +static modConfData_t *runModConf = NULL;/* modConf ptr to use for the current exec process */ + + +/* to be called to build the libee part of the instance ONCE ALL PARAMETERS ARE CORRECT + * (and set within pData!). + */ +static rsRetVal +buildInstance(instanceData *pData) +{ + DEFiRet; + if((pData->ctxee = ee_initCtx()) == NULL) { + errmsg.LogError(0, RS_RET_LIBEE_INIT, "error: could not initialize libee " + "ctx, cannot activate action"); + ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT); + } + + if((pData->ctxln = ln_initCtx()) == NULL) { + errmsg.LogError(0, RS_RET_LIBLOGNORM_INIT, "error: could not initialize " + "liblognorm ctx, cannot activate action"); + ee_exitCtx(pData->ctxee); + ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_INIT); + } + ln_setEECtx(pData->ctxln, pData->ctxee); + if(ln_loadSamples(pData->ctxln, (char*) pData->rulebase) != 0) { + errmsg.LogError(0, RS_RET_NO_RULESET, "error: normalization rulebase '%s' " + "could not be loaded cannot activate action", cs.rulebase); + ee_exitCtx(pData->ctxee); + ln_exitCtx(pData->ctxln); + ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_SAMPDB_LOAD); + } +finalize_it: + RETiRet; +} + + BEGINinitConfVars /* (re)set config variables to default values */ CODESTARTinitConfVars resetConfigVariables(NULL, NULL); @@ -86,6 +139,36 @@ CODESTARTcreateInstance ENDcreateInstance +BEGINbeginCnfLoad +CODESTARTbeginCnfLoad + loadModConf = pModConf; + pModConf->pConf = pConf; +ENDbeginCnfLoad + + +BEGINendCnfLoad +CODESTARTendCnfLoad + loadModConf = NULL; /* done loading */ + /* free legacy config vars */ + free(cs.rulebase); + cs.rulebase = NULL; +ENDendCnfLoad + +BEGINcheckCnf +CODESTARTcheckCnf +ENDcheckCnf + +BEGINactivateCnf +CODESTARTactivateCnf + runModConf = pModConf; +ENDactivateCnf + +BEGINfreeCnf +CODESTARTfreeCnf + free(pModConf->tplName); +ENDfreeCnf + + BEGINisCompatibleWithFeature CODESTARTisCompatibleWithFeature ENDisCompatibleWithFeature @@ -93,6 +176,7 @@ ENDisCompatibleWithFeature BEGINfreeInstance CODESTARTfreeInstance + free(pData->rulebase); ee_exitCtx(pData->ctxee); ln_exitCtx(pData->ctxln); ENDfreeInstance @@ -141,7 +225,7 @@ CODESTARTdoAction es_deleteStr(str); /* reformat to our json data struct */ - // TODO: this is all extremly ineffcient! + /* TODO: this is all extremly ineffcient! */ ee_fmtEventToJSON(event, &str); cstrJSON = es_str2cstr(str, NULL); dbgprintf("mmnormalize generated: %s\n", cstrJSON); @@ -156,6 +240,57 @@ CODESTARTdoAction ENDdoAction +static inline void +setInstParamDefaults(instanceData *pData) +{ + pData->rulebase = NULL; + pData->bUseRawMsg = 0; +} + +BEGINnewActInst + struct cnfparamvals *pvals; + uchar *tplToUse; + int i; + rsRetVal localRet; +CODESTARTnewActInst + DBGPRINTF("newActInst (mmnormalize)\n"); + + pvals = nvlstGetParams(lst, &actpblk, NULL); + if(pvals == NULL) { + errmsg.LogError(0, RS_RET_MISSING_CNFPARAMS, "mmnormalize: error reading " + "config parameters"); + ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS); + } + + if(Debug) { + dbgprintf("action param blk in mmnormalize:\n"); + cnfparamsPrint(&actpblk, pvals); + } + + CHKiRet(createInstance(&pData)); + setInstParamDefaults(pData); + + for(i = 0 ; i < actpblk.nParams ; ++i) { + if(!pvals[i].bUsed) + continue; + if(!strcmp(actpblk.descr[i].name, "rulebase")) { + pData->rulebase = es_str2cstr(pvals[i].val.d.estr, NULL); + } else if(!strcmp(actpblk.descr[i].name, "userawmsg")) { + pData->bUseRawMsg = (int) pvals[i].val.d.n; + } else { + DBGPRINTF("mmnormalize: program error, non-handled " + "param '%s'\n", actpblk.descr[i].name); + } + } + CODE_STD_STRING_REQUESTnewActInst(1) + CHKiRet(OMSRsetEntry(*ppOMSR, 0, NULL, OMSR_TPL_AS_MSG)); + + iRet = buildInstance(pData); +CODE_STD_FINALIZERnewActInst + cnfparamvalsDestruct(pvals, &actpblk); +ENDnewActInst + + BEGINparseSelectorAct CODESTARTparseSelectorAct CODE_STD_STRING_REQUESTparseSelectorAct(1) @@ -174,6 +309,12 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) p += sizeof(":mmnormalize:") - 1; /* eat indicator sequence (-1 because of '\0'!) */ CHKiRet(createInstance(&pData)); + pData->rulebase = cs.rulebase; + pData->bUseRawMsg = cs.bUseRawMsg; + /* all config vars auto-reset! */ + cs.bUseRawMsg = 0; + cs.rulebase = NULL; /* we used it up! */ + /* check if a non-standard template is to be applied */ if(*(p-1) == ';') --p; @@ -181,34 +322,7 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) * the format specified (if any) is always ignored. */ CHKiRet(cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_TPL_AS_MSG, (uchar*) "RSYSLOG_FileFormat")); - - /* finally build the instance */ - if((pData->ctxee = ee_initCtx()) == NULL) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize libee ctx, cannot " - "activate action"); - ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT); - } - - if((pData->ctxln = ln_initCtx()) == NULL) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize liblognorm ctx, cannot " - "activate action"); - ee_exitCtx(pData->ctxee); - ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_INIT); - } - ln_setEECtx(pData->ctxln, pData->ctxee); - if(ln_loadSamples(pData->ctxln, (char*) cs.rulebase) != 0) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: normalization rulebase '%s' could not be loaded " - "cannot activate action", cs.rulebase); - ee_exitCtx(pData->ctxee); - ln_exitCtx(pData->ctxln); - ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_SAMPDB_LOAD); - } - pData->bUseRawMsg = cs.bUseRawMsg; - - /* all config vars auto-reset! */ - cs.bUseRawMsg = 0; - free(cs.rulebase); - cs.rulebase = NULL; + CHKiRet(buildInstance(pData)); CODE_STD_FINALIZERparseSelectorAct ENDparseSelectorAct @@ -222,6 +336,8 @@ ENDmodExit BEGINqueryEtryPt CODESTARTqueryEtryPt CODEqueryEtryPt_STD_OMOD_QUERIES +CODEqueryEtryPt_STD_CONF2_QUERIES +CODEqueryEtryPt_STD_CONF2_OMOD_QUERIES ENDqueryEtryPt -- cgit v1.2.3 From b6e41c0d9e71459d82b551692f3aa0079dec3f8b Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 1 Nov 2012 19:03:52 +0100 Subject: bugfix: misaddressing of $mmnormalizeuserawmsg parameter On many platforms, this has no effect at all. At some, it may cause a segfault. The problem occurs only during config phase, no segfault happens when rsyslog has fully started. --- plugins/mmnormalize/mmnormalize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index c5b290f4..2dacb80b 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -67,7 +67,7 @@ typedef struct _instanceData { typedef struct configSettings_s { uchar *rulebase; /**< name of normalization rulebase to use */ - sbool bUseRawMsg; /**< use %rawmsg% instead of %msg% */ + int bUseRawMsg; /**< use %rawmsg% instead of %msg% */ } configSettings_t; static configSettings_t cs; -- cgit v1.2.3 From aaeb1945a7b7f8534edc04a03912c7942322fb83 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 27 Nov 2012 16:47:49 +0100 Subject: bugfix: mmnormalize build problems --- plugins/mmnormalize/mmnormalize.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 1aef98eb..36d8c9fb 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -104,13 +104,13 @@ buildInstance(instanceData *pData) { DEFiRet; if((pData->ctxee = ee_initCtx()) == NULL) { - errmsg.LogError(0, RS_RET_LIBEE_INIT, "error: could not initialize libee " + errmsg.LogError(0, RS_RET_ERR_LIBEE_INIT, "error: could not initialize libee " "ctx, cannot activate action"); ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT); } if((pData->ctxln = ln_initCtx()) == NULL) { - errmsg.LogError(0, RS_RET_LIBLOGNORM_INIT, "error: could not initialize " + errmsg.LogError(0, RS_RET_ERR_LIBLOGNORM_INIT, "error: could not initialize " "liblognorm ctx, cannot activate action"); ee_exitCtx(pData->ctxee); ABORT_FINALIZE(RS_RET_ERR_LIBLOGNORM_INIT); @@ -165,7 +165,6 @@ ENDactivateCnf BEGINfreeCnf CODESTARTfreeCnf - free(pModConf->tplName); ENDfreeCnf @@ -249,9 +248,7 @@ setInstParamDefaults(instanceData *pData) BEGINnewActInst struct cnfparamvals *pvals; - uchar *tplToUse; int i; - rsRetVal localRet; CODESTARTnewActInst DBGPRINTF("newActInst (mmnormalize)\n"); @@ -274,7 +271,7 @@ CODESTARTnewActInst if(!pvals[i].bUsed) continue; if(!strcmp(actpblk.descr[i].name, "rulebase")) { - pData->rulebase = es_str2cstr(pvals[i].val.d.estr, NULL); + pData->rulebase = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL); } else if(!strcmp(actpblk.descr[i].name, "userawmsg")) { pData->bUseRawMsg = (int) pvals[i].val.d.n; } else { -- cgit v1.2.3 From d9df6e977554f0bd1d42093ea62ca15dab223ff3 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 28 Nov 2012 10:02:08 +0100 Subject: bugfix: modules not (yet) supporting new conf format were not properly registered This lead to a "module not found" error message instead of the to-be-expected "module does not support new style" error message. That invalid error message could be quite misleading and actually stop people from addressing the real problem (aka "go nuts" ;)) --- plugins/mmnormalize/mmnormalize.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index b5f4ce18..d3fba39b 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -222,6 +222,7 @@ ENDmodExit BEGINqueryEtryPt CODESTARTqueryEtryPt CODEqueryEtryPt_STD_OMOD_QUERIES +CODEqueryEtryPt_STD_CONF2_CNFNAME_QUERIES ENDqueryEtryPt @@ -256,6 +257,7 @@ INITLegCnfVars *ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */ CODEmodInit_QueryRegCFSLineHdlr + DBGPRINTF("mmnormalize: module compiled with rsyslog version %s.\n", VERSION); /* check if the rsyslog core supports parameter passing code */ bMsgPassingSupported = 0; localRet = pHostQueryEtryPt((uchar*)"OMSRgetSupportedTplOpts", -- cgit v1.2.3 From 60217da3968bcc62048f6afd4c8c77565789c3da Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 28 Nov 2012 15:12:56 +0100 Subject: bugfix: mmnormalize could abort rsyslog if config parameter was in error --- plugins/mmnormalize/mmnormalize.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 2d42886b..9dbde497 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -249,15 +249,18 @@ setInstParamDefaults(instanceData *pData) BEGINnewActInst struct cnfparamvals *pvals; int i; + int bDestructPValsOnExit; CODESTARTnewActInst DBGPRINTF("newActInst (mmnormalize)\n"); + bDestructPValsOnExit = 0; pvals = nvlstGetParams(lst, &actpblk, NULL); if(pvals == NULL) { errmsg.LogError(0, RS_RET_MISSING_CNFPARAMS, "mmnormalize: error reading " "config parameters"); ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS); } + bDestructPValsOnExit = 1; if(Debug) { dbgprintf("action param blk in mmnormalize:\n"); @@ -284,7 +287,8 @@ CODESTARTnewActInst iRet = buildInstance(pData); CODE_STD_FINALIZERnewActInst - cnfparamvalsDestruct(pvals, &actpblk); + if(bDestructPValsOnExit) + cnfparamvalsDestruct(pvals, &actpblk); ENDnewActInst -- cgit v1.2.3 From 7df68798be96d38fcb17143daa2c3e2b093a8ba5 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Fri, 30 Nov 2012 09:59:02 +0100 Subject: bugfix[minor]: invalid error code when mmnormalize could not access rulebase --- plugins/mmnormalize/mmnormalize.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index 9dbde497..fd2004a3 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -117,7 +117,7 @@ buildInstance(instanceData *pData) } ln_setEECtx(pData->ctxln, pData->ctxee); if(ln_loadSamples(pData->ctxln, (char*) pData->rulebase) != 0) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: normalization rulebase '%s' " + errmsg.LogError(0, RS_RET_NO_RULEBASE, "error: normalization rulebase '%s' " "could not be loaded cannot activate action", cs.rulebase); ee_exitCtx(pData->ctxee); ln_exitCtx(pData->ctxln); @@ -301,9 +301,9 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1) } if(cs.rulebase == NULL) { - errmsg.LogError(0, RS_RET_NO_RULESET, "error: no normalization rulebase was specified, use " + errmsg.LogError(0, RS_RET_NO_RULEBASE, "error: no normalization rulebase was specified, use " "$MMNormalizeSampleDB directive first!"); - ABORT_FINALIZE(RS_RET_NO_RULESET); + ABORT_FINALIZE(RS_RET_NO_RULEBASE); } /* ok, if we reach this point, we have something for us */ -- cgit v1.2.3 From 5b76d639659fe5582b425b903fa8f5e14624a8e4 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 20 Mar 2013 11:03:41 +0100 Subject: bugfix: $mmnormalizeuseramsg paramter was specified with wrong type Thanks to Renzhong Zhang for alerting us of the problem. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=420 --- plugins/mmnormalize/mmnormalize.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'plugins/mmnormalize/mmnormalize.c') diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c index d3fba39b..c366d5fe 100644 --- a/plugins/mmnormalize/mmnormalize.c +++ b/plugins/mmnormalize/mmnormalize.c @@ -281,7 +281,7 @@ CODEmodInit_QueryRegCFSLineHdlr CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizerulebase", 0, eCmdHdlrGetWord, setRuleBase, NULL, STD_LOADABLE_MODULE_ID)); - CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizeuserawmsg", 0, eCmdHdlrInt, + CHKiRet(omsdRegCFSLineHdlr((uchar *)"mmnormalizeuserawmsg", 0, eCmdHdlrBinary, NULL, &cs.bUseRawMsg, STD_LOADABLE_MODULE_ID)); CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID)); -- cgit v1.2.3