static void
log_rewrite_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogRewrite *self = (LogRewrite *) s;
gchar buf[128];
gssize length;
const gchar *value;
if (self->condition && !filter_expr_eval_root(self->condition, &msg, path_options))
{
msg_debug("Rewrite condition unmatched, skipping rewrite",
evt_tag_str("value", log_msg_get_value_name(self->value_handle, NULL)),
NULL);
}
else
{
self->process(self, &msg, path_options);
}
if (G_UNLIKELY(debug_flag))
{
value = log_msg_get_value(msg, self->value_handle, &length);
msg_debug("Rewrite expression evaluation result",
evt_tag_str("value", log_msg_get_value_name(self->value_handle, NULL)),
evt_tag_printf("new_value", "%.*s", (gint) length, value),
evt_tag_str("rule", self->name),
evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))),
NULL);
}
log_pipe_forward_msg(s, msg, path_options);
}
static void
log_filter_pipe_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogFilterPipe *self = (LogFilterPipe *) s;
gchar buf[128];
gboolean res;
msg_debug("Filter rule evaluation begins",
evt_tag_str("rule", self->name),
evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))),
NULL);
if (self->expr->modify)
log_msg_make_writable(&msg, path_options);
res = filter_expr_eval(self->expr, msg);
msg_debug("Filter rule evaluation result",
evt_tag_str("result", res ? "match" : "not-match"),
evt_tag_str("rule", self->name),
evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))),
NULL);
if (res)
{
log_pipe_forward_msg(s, msg, path_options);
}
else
{
if (path_options->matched)
(*path_options->matched) = FALSE;
log_msg_drop(msg, path_options);
}
}
void
log_dest_driver_queue_method(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogDestDriver *self = (LogDestDriver *) s;
stats_counter_inc(self->super.processed_group_messages);
stats_counter_inc(self->queued_global_messages);
log_pipe_forward_msg(s, msg, path_options);
}
static void
log_multiplexer_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogMultiplexer *self = (LogMultiplexer *) s;
gint i;
LogPathOptions local_options = *path_options;
gboolean matched;
gboolean delivered = FALSE;
gboolean last_delivery;
gint fallback;
local_options.matched = &matched;
for (fallback = 0; (fallback == 0) || (fallback == 1 && self->fallback_exists && !delivered); fallback++)
{
for (i = 0; i < self->next_hops->len; i++)
{
LogPipe *next_hop = g_ptr_array_index(self->next_hops, i);
if (G_UNLIKELY(fallback == 0 && (next_hop->flags & PIF_BRANCH_FALLBACK) != 0))
{
continue;
}
else if (G_UNLIKELY(fallback && (next_hop->flags & PIF_BRANCH_FALLBACK) == 0))
{
continue;
}
matched = TRUE;
log_msg_add_ack(msg, &local_options);
/* NOTE: this variable indicates that the upcoming message
* delivery is the last one, thus we don't need to retain an an
* unmodified copy to be sent to further paths. The current
* delivery may modify the message at will.
*/
last_delivery = (self->super.pipe_next == NULL) &&
(i == self->next_hops->len - 1) &&
(!self->fallback_exists || delivered || fallback == 1);
if (!last_delivery)
log_msg_write_protect(msg);
log_pipe_queue(next_hop, log_msg_ref(msg), &local_options);
if (!last_delivery)
log_msg_write_unprotect(msg);
if (matched)
{
delivered = TRUE;
if (G_UNLIKELY(next_hop->flags & PIF_BRANCH_FINAL))
break;
}
}
}
log_pipe_forward_msg(s, msg, path_options);
}
static void
affile_sd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options)
{
AFFileSourceDriver *self = (AFFileSourceDriver *) s;
static NVHandle filename_handle = 0;
if (!filename_handle)
filename_handle = log_msg_get_value_handle("FILE_NAME");
log_msg_set_value(msg, filename_handle, self->filename->str, self->filename->len);
log_pipe_forward_msg(s, msg, path_options);
}
static void
afinet_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options)
{
#if ENABLE_SPOOF_SOURCE
AFInetDestDriver *self = (AFInetDestDriver *) s;
if (self->spoof_source && self->lnet_ctx && msg->saddr && (msg->saddr->sa.sa_family == AF_INET || msg->saddr->sa.sa_family == AF_INET6))
{
gboolean success = FALSE;
GString *msg_line = g_string_sized_new(256);
g_assert((self->super.flags & AFSOCKET_DGRAM) != 0);
log_writer_format_log((LogWriter *) self->super.writer, msg, msg_line);
switch (self->super.dest_addr->sa.sa_family)
{
case AF_INET:
success = afinet_dd_construct_ipv4_packet(self, msg, msg_line);
break;
#if ENABLE_IPV6
case AF_INET6:
success = afinet_dd_construct_ipv6_packet(self, msg, msg_line);
break;
#endif
default:
g_assert_not_reached();
}
if (success)
{
if (libnet_write(self->lnet_ctx) >= 0)
{
/* we have finished processing msg */
log_msg_ack(msg, path_options);
log_msg_unref(msg);
g_string_free(msg_line, TRUE);
return;
}
else
{
msg_error("Error sending raw frame",
evt_tag_str("error", libnet_geterror(self->lnet_ctx)),
NULL);
}
}
g_string_free(msg_line, TRUE);
}
#endif
log_pipe_forward_msg(s, msg, path_options);
}
void
log_src_driver_queue_method(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogSrcDriver *self = (LogSrcDriver *) s;
GlobalConfig *cfg = log_pipe_get_config(s);
/* $SOURCE */
if (msg->flags & LF_LOCAL)
afinter_postpone_mark(cfg->mark_freq);
log_msg_set_value(msg, LM_V_SOURCE, self->super.group, self->group_len);
stats_counter_inc(self->super.processed_group_messages);
stats_counter_inc(self->received_global_messages);
log_pipe_forward_msg(s, msg, path_options);
}
static void
log_multiplexer_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogMultiplexer *self = (LogMultiplexer *) s;
gint i;
LogPathOptions local_options = *path_options;
gboolean matched;
gboolean delivered = FALSE;
gint fallback;
local_options.matched = &matched;
for (fallback = 0; (fallback == 0) || (fallback == 1 && self->fallback_exists && !delivered); fallback++)
{
for (i = 0; i < self->next_hops->len; i++)
{
LogPipe *next_hop = g_ptr_array_index(self->next_hops, i);
if (G_UNLIKELY(fallback == 0 && (next_hop->flags & PIF_BRANCH_FALLBACK) != 0))
{
continue;
}
else if (G_UNLIKELY(fallback && (next_hop->flags & PIF_BRANCH_FALLBACK) == 0))
{
continue;
}
matched = TRUE;
log_msg_add_ack(msg, &local_options);
log_pipe_queue(next_hop, log_msg_ref(msg), &local_options);
if (matched)
{
delivered = TRUE;
if (G_UNLIKELY(next_hop->flags & PIF_BRANCH_FINAL))
break;
}
}
}
log_pipe_forward_msg(s, msg, path_options);
}
static void
log_db_parser_emit(LogMessage *msg, gboolean synthetic, gpointer user_data)
{
LogDBParser *self = (LogDBParser *) user_data;
if (synthetic)
{
if (self->inject_mode == LDBP_IM_PASSTHROUGH)
{
LogPathOptions path_options = LOG_PATH_OPTIONS_INIT;
path_options.ack_needed = FALSE;
log_pipe_forward_msg(&self->super.super, log_msg_ref(msg), &path_options);
}
else
{
msg_post_message(log_msg_ref(msg));
}
msg_debug("db-parser: emitting synthetic message",
evt_tag_str("msg", log_msg_get_value(msg, LM_V_MESSAGE, NULL)),
NULL);
}
}
static void
log_source_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogSource *self = (LogSource *) s;
LogPathOptions local_options = *path_options;
gint old_window_size;
gint i;
msg_set_context(msg);
if (msg->timestamps[LM_TS_STAMP].tv_sec == -1 || !self->options->keep_timestamp)
msg->timestamps[LM_TS_STAMP] = msg->timestamps[LM_TS_RECVD];
g_assert(msg->timestamps[LM_TS_STAMP].zone_offset != -1);
ack_tracker_track_msg(self->ack_tracker, msg);
/* $HOST setup */
log_source_mangle_hostname(self, msg);
/* $PROGRAM override */
if (self->options->program_override)
{
if (self->options->program_override_len < 0)
self->options->program_override_len = strlen(self->options->program_override);
log_msg_set_value(msg, LM_V_PROGRAM, self->options->program_override, self->options->program_override_len);
}
/* $HOST override */
if (self->options->host_override)
{
if (self->options->host_override_len < 0)
self->options->host_override_len = strlen(self->options->host_override);
log_msg_set_value(msg, LM_V_HOST, self->options->host_override, self->options->host_override_len);
}
/* source specific tags */
if (self->options->tags)
{
for (i = 0; i < self->options->tags->len; i++)
{
log_msg_set_tag_by_id(msg, g_array_index(self->options->tags, LogTagId, i));
}
}
log_msg_set_tag_by_id(msg, self->options->source_group_tag);
/* stats counters */
if (stats_check_level(2))
{
stats_lock();
stats_register_and_increment_dynamic_counter(2, SCS_HOST | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST, NULL), msg->timestamps[LM_TS_RECVD].tv_sec);
if (stats_check_level(3))
{
stats_register_and_increment_dynamic_counter(3, SCS_SENDER | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST_FROM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec);
stats_register_and_increment_dynamic_counter(3, SCS_PROGRAM | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_PROGRAM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec);
}
stats_unlock();
}
stats_syslog_process_message_pri(msg->pri);
/* message setup finished, send it out */
/* NOTE: we start by enabling flow-control, thus we need an acknowledgement */
local_options.ack_needed = TRUE;
log_msg_ref(msg);
log_msg_add_ack(msg, &local_options);
msg->ack_func = log_source_msg_ack;
old_window_size = g_atomic_counter_exchange_and_add(&self->window_size, -1);
/*
* NOTE: this assertion validates that the source is not overflowing its
* own flow-control window size, decreased above, by the atomic statement.
*
* If the _old_ value is zero, that means that the decrement operation
* above has decreased the value to -1.
*/
g_assert(old_window_size > 0);
stats_counter_inc(self->recvd_messages);
stats_counter_set(self->last_message_seen, msg->timestamps[LM_TS_RECVD].tv_sec);
log_pipe_forward_msg(s, msg, &local_options);
msg_set_context(NULL);
if (accurate_nanosleep && self->threaded && self->window_full_sleep_nsec > 0 && !log_source_free_to_send(self))
{
struct timespec ts;
/* wait one 0.1msec in the hope that the buffer clears up */
ts.tv_sec = 0;
ts.tv_nsec = self->window_full_sleep_nsec;
nanosleep(&ts, NULL);
}
}
static void
log_source_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data)
{
LogSource *self = (LogSource *) s;
gint i;
msg_set_context(msg);
if (msg->timestamps[LM_TS_STAMP].tv_sec == -1 || !self->options->keep_timestamp)
msg->timestamps[LM_TS_STAMP] = msg->timestamps[LM_TS_RECVD];
g_assert(msg->timestamps[LM_TS_STAMP].zone_offset != -1);
/* $HOST setup */
log_source_mangle_hostname(self, msg);
/* $PROGRAM override */
if (self->options->program_override)
{
if (self->options->program_override_len < 0)
self->options->program_override_len = strlen(self->options->program_override);
log_msg_set_value(msg, LM_V_PROGRAM, self->options->program_override, self->options->program_override_len);
}
/* $HOST override */
if (self->options->host_override)
{
if (self->options->host_override_len < 0)
self->options->host_override_len = strlen(self->options->host_override);
log_msg_set_value(msg, LM_V_HOST, self->options->host_override, self->options->host_override_len);
}
/* source specific tags */
if (self->options->tags)
{
for (i = 0; i < self->options->tags->len; i++)
{
log_msg_set_tag_by_id(msg, g_array_index(self->options->tags, LogTagId, i));
}
}
log_msg_set_tag_by_id(msg, self->options->source_group_tag);
/* stats counters */
if (stats_check_level(2))
{
stats_lock();
stats_register_and_increment_dynamic_counter(2, SCS_HOST | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST, NULL), msg->timestamps[LM_TS_RECVD].tv_sec);
if (stats_check_level(3))
{
stats_register_and_increment_dynamic_counter(3, SCS_SENDER | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST_FROM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec);
stats_register_and_increment_dynamic_counter(3, SCS_PROGRAM | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_PROGRAM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec);
}
stats_unlock();
}
stats_syslog_process_message_pri(msg->pri);
/* message setup finished, send it out */
stats_counter_inc(self->recvd_messages);
stats_counter_set(self->last_message_seen, msg->timestamps[LM_TS_RECVD].tv_sec);
log_pipe_forward_msg(s, msg, path_options);
msg_set_context(NULL);
if (accurate_nanosleep && self->threaded && self->window_full_sleep_nsec > 0 && !log_source_free_to_send(self))
{
struct timespec ts;
/* wait one 0.1msec in the hope that the buffer clears up */
ts.tv_sec = 0;
ts.tv_nsec = self->window_full_sleep_nsec;
nanosleep(&ts, NULL);
}
}