static void log_rewrite_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogRewrite *self = (LogRewrite *) s; gchar buf[128]; gssize length; const gchar *value; if (self->condition && !filter_expr_eval_root(self->condition, &msg, path_options)) { msg_debug("Rewrite condition unmatched, skipping rewrite", evt_tag_str("value", log_msg_get_value_name(self->value_handle, NULL)), NULL); } else { self->process(self, &msg, path_options); } if (G_UNLIKELY(debug_flag)) { value = log_msg_get_value(msg, self->value_handle, &length); msg_debug("Rewrite expression evaluation result", evt_tag_str("value", log_msg_get_value_name(self->value_handle, NULL)), evt_tag_printf("new_value", "%.*s", (gint) length, value), evt_tag_str("rule", self->name), evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))), NULL); } log_pipe_forward_msg(s, msg, path_options); }
static void log_filter_pipe_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogFilterPipe *self = (LogFilterPipe *) s; gchar buf[128]; gboolean res; msg_debug("Filter rule evaluation begins", evt_tag_str("rule", self->name), evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))), NULL); if (self->expr->modify) log_msg_make_writable(&msg, path_options); res = filter_expr_eval(self->expr, msg); msg_debug("Filter rule evaluation result", evt_tag_str("result", res ? "match" : "not-match"), evt_tag_str("rule", self->name), evt_tag_str("location", log_expr_node_format_location(s->expr_node, buf, sizeof(buf))), NULL); if (res) { log_pipe_forward_msg(s, msg, path_options); } else { if (path_options->matched) (*path_options->matched) = FALSE; log_msg_drop(msg, path_options); } }
void log_dest_driver_queue_method(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogDestDriver *self = (LogDestDriver *) s; stats_counter_inc(self->super.processed_group_messages); stats_counter_inc(self->queued_global_messages); log_pipe_forward_msg(s, msg, path_options); }
static void log_multiplexer_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogMultiplexer *self = (LogMultiplexer *) s; gint i; LogPathOptions local_options = *path_options; gboolean matched; gboolean delivered = FALSE; gboolean last_delivery; gint fallback; local_options.matched = &matched; for (fallback = 0; (fallback == 0) || (fallback == 1 && self->fallback_exists && !delivered); fallback++) { for (i = 0; i < self->next_hops->len; i++) { LogPipe *next_hop = g_ptr_array_index(self->next_hops, i); if (G_UNLIKELY(fallback == 0 && (next_hop->flags & PIF_BRANCH_FALLBACK) != 0)) { continue; } else if (G_UNLIKELY(fallback && (next_hop->flags & PIF_BRANCH_FALLBACK) == 0)) { continue; } matched = TRUE; log_msg_add_ack(msg, &local_options); /* NOTE: this variable indicates that the upcoming message * delivery is the last one, thus we don't need to retain an an * unmodified copy to be sent to further paths. The current * delivery may modify the message at will. */ last_delivery = (self->super.pipe_next == NULL) && (i == self->next_hops->len - 1) && (!self->fallback_exists || delivered || fallback == 1); if (!last_delivery) log_msg_write_protect(msg); log_pipe_queue(next_hop, log_msg_ref(msg), &local_options); if (!last_delivery) log_msg_write_unprotect(msg); if (matched) { delivered = TRUE; if (G_UNLIKELY(next_hop->flags & PIF_BRANCH_FINAL)) break; } } } log_pipe_forward_msg(s, msg, path_options); }
static void affile_sd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options) { AFFileSourceDriver *self = (AFFileSourceDriver *) s; static NVHandle filename_handle = 0; if (!filename_handle) filename_handle = log_msg_get_value_handle("FILE_NAME"); log_msg_set_value(msg, filename_handle, self->filename->str, self->filename->len); log_pipe_forward_msg(s, msg, path_options); }
static void afinet_dd_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options) { #if ENABLE_SPOOF_SOURCE AFInetDestDriver *self = (AFInetDestDriver *) s; if (self->spoof_source && self->lnet_ctx && msg->saddr && (msg->saddr->sa.sa_family == AF_INET || msg->saddr->sa.sa_family == AF_INET6)) { gboolean success = FALSE; GString *msg_line = g_string_sized_new(256); g_assert((self->super.flags & AFSOCKET_DGRAM) != 0); log_writer_format_log((LogWriter *) self->super.writer, msg, msg_line); switch (self->super.dest_addr->sa.sa_family) { case AF_INET: success = afinet_dd_construct_ipv4_packet(self, msg, msg_line); break; #if ENABLE_IPV6 case AF_INET6: success = afinet_dd_construct_ipv6_packet(self, msg, msg_line); break; #endif default: g_assert_not_reached(); } if (success) { if (libnet_write(self->lnet_ctx) >= 0) { /* we have finished processing msg */ log_msg_ack(msg, path_options); log_msg_unref(msg); g_string_free(msg_line, TRUE); return; } else { msg_error("Error sending raw frame", evt_tag_str("error", libnet_geterror(self->lnet_ctx)), NULL); } } g_string_free(msg_line, TRUE); } #endif log_pipe_forward_msg(s, msg, path_options); }
void log_src_driver_queue_method(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogSrcDriver *self = (LogSrcDriver *) s; GlobalConfig *cfg = log_pipe_get_config(s); /* $SOURCE */ if (msg->flags & LF_LOCAL) afinter_postpone_mark(cfg->mark_freq); log_msg_set_value(msg, LM_V_SOURCE, self->super.group, self->group_len); stats_counter_inc(self->super.processed_group_messages); stats_counter_inc(self->received_global_messages); log_pipe_forward_msg(s, msg, path_options); }
static void log_multiplexer_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogMultiplexer *self = (LogMultiplexer *) s; gint i; LogPathOptions local_options = *path_options; gboolean matched; gboolean delivered = FALSE; gint fallback; local_options.matched = &matched; for (fallback = 0; (fallback == 0) || (fallback == 1 && self->fallback_exists && !delivered); fallback++) { for (i = 0; i < self->next_hops->len; i++) { LogPipe *next_hop = g_ptr_array_index(self->next_hops, i); if (G_UNLIKELY(fallback == 0 && (next_hop->flags & PIF_BRANCH_FALLBACK) != 0)) { continue; } else if (G_UNLIKELY(fallback && (next_hop->flags & PIF_BRANCH_FALLBACK) == 0)) { continue; } matched = TRUE; log_msg_add_ack(msg, &local_options); log_pipe_queue(next_hop, log_msg_ref(msg), &local_options); if (matched) { delivered = TRUE; if (G_UNLIKELY(next_hop->flags & PIF_BRANCH_FINAL)) break; } } } log_pipe_forward_msg(s, msg, path_options); }
static void log_db_parser_emit(LogMessage *msg, gboolean synthetic, gpointer user_data) { LogDBParser *self = (LogDBParser *) user_data; if (synthetic) { if (self->inject_mode == LDBP_IM_PASSTHROUGH) { LogPathOptions path_options = LOG_PATH_OPTIONS_INIT; path_options.ack_needed = FALSE; log_pipe_forward_msg(&self->super.super, log_msg_ref(msg), &path_options); } else { msg_post_message(log_msg_ref(msg)); } msg_debug("db-parser: emitting synthetic message", evt_tag_str("msg", log_msg_get_value(msg, LM_V_MESSAGE, NULL)), NULL); } }
static void log_source_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogSource *self = (LogSource *) s; LogPathOptions local_options = *path_options; gint old_window_size; gint i; msg_set_context(msg); if (msg->timestamps[LM_TS_STAMP].tv_sec == -1 || !self->options->keep_timestamp) msg->timestamps[LM_TS_STAMP] = msg->timestamps[LM_TS_RECVD]; g_assert(msg->timestamps[LM_TS_STAMP].zone_offset != -1); ack_tracker_track_msg(self->ack_tracker, msg); /* $HOST setup */ log_source_mangle_hostname(self, msg); /* $PROGRAM override */ if (self->options->program_override) { if (self->options->program_override_len < 0) self->options->program_override_len = strlen(self->options->program_override); log_msg_set_value(msg, LM_V_PROGRAM, self->options->program_override, self->options->program_override_len); } /* $HOST override */ if (self->options->host_override) { if (self->options->host_override_len < 0) self->options->host_override_len = strlen(self->options->host_override); log_msg_set_value(msg, LM_V_HOST, self->options->host_override, self->options->host_override_len); } /* source specific tags */ if (self->options->tags) { for (i = 0; i < self->options->tags->len; i++) { log_msg_set_tag_by_id(msg, g_array_index(self->options->tags, LogTagId, i)); } } log_msg_set_tag_by_id(msg, self->options->source_group_tag); /* stats counters */ if (stats_check_level(2)) { stats_lock(); stats_register_and_increment_dynamic_counter(2, SCS_HOST | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST, NULL), msg->timestamps[LM_TS_RECVD].tv_sec); if (stats_check_level(3)) { stats_register_and_increment_dynamic_counter(3, SCS_SENDER | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST_FROM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec); stats_register_and_increment_dynamic_counter(3, SCS_PROGRAM | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_PROGRAM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec); } stats_unlock(); } stats_syslog_process_message_pri(msg->pri); /* message setup finished, send it out */ /* NOTE: we start by enabling flow-control, thus we need an acknowledgement */ local_options.ack_needed = TRUE; log_msg_ref(msg); log_msg_add_ack(msg, &local_options); msg->ack_func = log_source_msg_ack; old_window_size = g_atomic_counter_exchange_and_add(&self->window_size, -1); /* * NOTE: this assertion validates that the source is not overflowing its * own flow-control window size, decreased above, by the atomic statement. * * If the _old_ value is zero, that means that the decrement operation * above has decreased the value to -1. */ g_assert(old_window_size > 0); stats_counter_inc(self->recvd_messages); stats_counter_set(self->last_message_seen, msg->timestamps[LM_TS_RECVD].tv_sec); log_pipe_forward_msg(s, msg, &local_options); msg_set_context(NULL); if (accurate_nanosleep && self->threaded && self->window_full_sleep_nsec > 0 && !log_source_free_to_send(self)) { struct timespec ts; /* wait one 0.1msec in the hope that the buffer clears up */ ts.tv_sec = 0; ts.tv_nsec = self->window_full_sleep_nsec; nanosleep(&ts, NULL); } }
static void log_source_queue(LogPipe *s, LogMessage *msg, const LogPathOptions *path_options, gpointer user_data) { LogSource *self = (LogSource *) s; gint i; msg_set_context(msg); if (msg->timestamps[LM_TS_STAMP].tv_sec == -1 || !self->options->keep_timestamp) msg->timestamps[LM_TS_STAMP] = msg->timestamps[LM_TS_RECVD]; g_assert(msg->timestamps[LM_TS_STAMP].zone_offset != -1); /* $HOST setup */ log_source_mangle_hostname(self, msg); /* $PROGRAM override */ if (self->options->program_override) { if (self->options->program_override_len < 0) self->options->program_override_len = strlen(self->options->program_override); log_msg_set_value(msg, LM_V_PROGRAM, self->options->program_override, self->options->program_override_len); } /* $HOST override */ if (self->options->host_override) { if (self->options->host_override_len < 0) self->options->host_override_len = strlen(self->options->host_override); log_msg_set_value(msg, LM_V_HOST, self->options->host_override, self->options->host_override_len); } /* source specific tags */ if (self->options->tags) { for (i = 0; i < self->options->tags->len; i++) { log_msg_set_tag_by_id(msg, g_array_index(self->options->tags, LogTagId, i)); } } log_msg_set_tag_by_id(msg, self->options->source_group_tag); /* stats counters */ if (stats_check_level(2)) { stats_lock(); stats_register_and_increment_dynamic_counter(2, SCS_HOST | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST, NULL), msg->timestamps[LM_TS_RECVD].tv_sec); if (stats_check_level(3)) { stats_register_and_increment_dynamic_counter(3, SCS_SENDER | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_HOST_FROM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec); stats_register_and_increment_dynamic_counter(3, SCS_PROGRAM | SCS_SOURCE, NULL, log_msg_get_value(msg, LM_V_PROGRAM, NULL), msg->timestamps[LM_TS_RECVD].tv_sec); } stats_unlock(); } stats_syslog_process_message_pri(msg->pri); /* message setup finished, send it out */ stats_counter_inc(self->recvd_messages); stats_counter_set(self->last_message_seen, msg->timestamps[LM_TS_RECVD].tv_sec); log_pipe_forward_msg(s, msg, path_options); msg_set_context(NULL); if (accurate_nanosleep && self->threaded && self->window_full_sleep_nsec > 0 && !log_source_free_to_send(self)) { struct timespec ts; /* wait one 0.1msec in the hope that the buffer clears up */ ts.tv_sec = 0; ts.tv_nsec = self->window_full_sleep_nsec; nanosleep(&ts, NULL); } }