- changed interface "printchopped()" so that it looks more like a generic

    message submission interface. Part of the ongoing modularization
    effort.
- bugfix: invalid kernel log format -- see bug
    http://bugzilla.adiscon.com/show_bug.cgi?id=1

8 files changed, 38 insertions, 25 deletions

diff --git a/ChangeLog b/ChangeLog
index 322aa6af..429477b5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 ---------------------------------------------------------------------------
 Version 3.11.3 (rgerhards), 2008-02-??
+- slightly improved man pages for novice users
+- fixed a bug in imklog which lead to duplicate message content in
+  kernel logs
 ---------------------------------------------------------------------------
 Version 3.11.2 (rgerhards), 2008-02-15
 - added the capability to monitor text files and process their content
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 5bc0f068..6e6f486d 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -130,6 +130,8 @@ static rsRetVal writeSyslogV(int iPRI, const char *szFmt, va_list va)
 
 	/* here we must create our message object and supply it to the message queue
 	 */
+	CHKiRet(parseAndSubmitMessage(LocalHostName, msgBuf, strlen(msgBuf), MSG_DONT_PARSE_HOSTNAME));
+#if 0
 	CHKiRet(msgConstruct(&pMsg));
 	MsgSetUxTradMsg(pMsg, msgBuf);
 	MsgSetRawMsg(pMsg, msgBuf);
@@ -143,6 +145,7 @@ static rsRetVal writeSyslogV(int iPRI, const char *szFmt, va_list va)
 
 	/* provide message to the queue engine */
 	logmsg(pMsg, INTERNAL_MSG);
+#endif
 
 finalize_it:
 	RETiRet;
diff --git a/plugins/imtemplate/imtemplate.c b/plugins/imtemplate/imtemplate.c
index 867f2778..e1e29ba6 100644
--- a/plugins/imtemplate/imtemplate.c
+++ b/plugins/imtemplate/imtemplate.c
@@ -255,10 +255,10 @@ CODESTARTrunInput
 		 * in syslogd.c (sorry, folks...).
 		 *
 		 * If you received a full syslog message that must be decoded by a message
-		 * parser, printchopped() is the way to go. It's not just a funny name
+		 * parser, parseAndSubmitMessage() is the way to go. It's not just a funny name
 		 * but also a quite some legacy. Consequently, its interface is, ummm, not
 		 * well designed.
-		 *     printchopped((char*)fromHost, (char*) pRcvBuf, lenRcvd,  fd, bParseHost);
+		 *     parseAndSubmitMessage((char*)fromHost, (char*) pRcvBuf, lenRcvd, bParseHost);
 		 *     fromHost
 		 *     	 is the host that we received the message from (a string)
 		 *     pRcvBuf
@@ -268,14 +268,11 @@ CODESTARTrunInput
 		 *       NOT a standard C-string. Most importantly it is NOT expected to be
 		 *       \0-terminated. Thus the lenght is vitally imporant (if it is wrong,
 		 *       rsyslogd will probably segfault).
-		 *     fd
-		 *       is the file descriptor that the message was received from. It is
-		 *       purely used for displaying purposes. If you don't have a file
-		 *       descriptor, simply provide the value 0.
 		 *     bParseHost
 		 *       is a boolean (0-no, 1-yes). It tells the parser whether or not
 		 *       a hostname should be parsed from the message. This is important
 		 *       for sources that are known not to provide a hostname.
+		 *       Use define MSG_PARSE_HOSTNAME and MSG_DONT_PARSE_HOSTNAME
 		 *
 		 * Another, more elaborate, way is to create the message object ourselves and
 		 * pass it to the rule engine. That way is more appropriate if the message 
diff --git a/plugins/imudp/imudp.c b/plugins/imudp/imudp.c
index fa9db53a..fa979039 100644
--- a/plugins/imudp/imudp.c
+++ b/plugins/imudp/imudp.c
@@ -190,7 +190,7 @@ CODESTARTrunInput
 							*/
 						       if(isAllowedSender(pAllowedSenders_UDP,
 							  (struct sockaddr *)&frominet, (char*)fromHostFQDN)) {
-							       printchopped((char*)fromHost, (char*) pRcvBuf, l,  udpLstnSocks[i+1], 1);
+							       parseAndSubmitMessage((char*)fromHost, (char*) pRcvBuf, l,  MSG_PARSE_HOSTNAME);
 						       } else {
 							       dbgprintf("%s is not an allowed sender\n", (char*)fromHostFQDN);
 							       if(option_DisallowWarning) {
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index 54bbe039..819057df 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -167,7 +167,7 @@ static rsRetVal readSocket(int fd, int bParseHost)
 	iRcvd = recv(fd, line, MAXLINE - 1, 0);
 	dbgprintf("Message from UNIX socket: #%d\n", fd);
 	if (iRcvd > 0) {
-		printchopped(LocalHostName, line, iRcvd,  fd, bParseHost);
+		parseAndSubmitMessage(LocalHostName, line, iRcvd, bParseHost);
 	} else if (iRcvd < 0 && errno != EINTR) {
 		char errStr[1024];
 		rs_strerror_r(errno, errStr, sizeof(errStr));
diff --git a/syslogd.c b/syslogd.c
index 71378f6e..82fd7c74 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -1265,7 +1265,10 @@ finalize_it:
 }
 
 
-/* rgerhards, 2006-11-30: I have greatly changed this function. Formerly,
+/* This takes a received message that must be decoded and submits it to
+ * the main message queue. The function calls the necessary parser.
+ *
+ * rgerhards, 2006-11-30: I have greatly changed this function. Formerly,
  * it tried to reassemble multi-part messages, which is a legacy stock
  * sysklogd concept. In essence, that was that messages not ending with
  * \0 were glued together. As far as I can see, this is a sysklogd
@@ -1284,9 +1287,18 @@ finalize_it:
  * For rfc3195 support, we needed to modify the algo for host parsing, so we can
  * no longer rely just on the source (rfc3195d forwarded messages arrive via
  * unix domain sockets but contain the hostname). rgerhards, 2005-10-06
+ *
+ * rgerhards, 2008-02-18:
+ * This function was previously called "printchopped"() and has been renamed
+ * as part of the effort to create a clean internal message submission interface.
+ * It also has been adopted to our usual calling interface, but currently does
+ * not provide any useful return states. But we now have the hook and things can
+ * improve in the future. <-- TODO!
  */
-void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
+rsRetVal
+parseAndSubmitMessage(char *hname, char *msg, int len, int bParseHost)
 {
+	DEFiRet;
 	register int iMsg;
 	char *pMsg;
 	char *pData;
@@ -1301,8 +1313,6 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
 	assert(msg != NULL);
 	assert(len >= 0);
 
-	dbgprintf("Message length: %d, File descriptor: %d.\n", len, fd);
-
 	/* we first check if we have a NUL character at the very end of the
 	 * message. This seems to be a frequent problem with a number of senders.
 	 * So I have now decided to drop these NULs. However, if they are intentional,
@@ -1362,7 +1372,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
 			logerrorInt("Uncompression of a message failed with return code %d "
 			            "- enable debug logging if you need further information. "
 				    "Message ignored.", ret);
-			return; /* unconditional exit, nothing left to do... */
+			FINALIZE; /* unconditional exit, nothing left to do... */
 		}
 		pData = deflateBuf;
 		pEnd = deflateBuf + iLenDefBuf;
@@ -1374,7 +1384,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
 	if(len > 0 && *msg == 'z') {
 		logerror("Received a compressed message, but rsyslogd does not have compression "
 		         "support enabled. The message will be ignored.");
-		return;
+		FINALIZE;
 	}	
 #	endif /* ifdef USE_NETZIP */
 
@@ -1396,7 +1406,7 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
 				 */
 				dbgprintf("internal error: iMsg > MAXLINE in printchopped()\n");
 			}
-			return; /* in this case, we are done... nothing left we can do */
+			FINALIZE; /* in this case, we are done... nothing left we can do */
 		}
 		if(*pData == '\0') { /* guard against \0 characters... */
 			/* changed to the sequence (somewhat) proposed in
@@ -1439,7 +1449,8 @@ void printchopped(char *hname, char *msg, int len, int fd, int bParseHost)
 	/* typically, we should end up here! */
 	printline(hname, tmpline, bParseHost);
 
-	return;
+finalize_it:
+	RETiRet;
 }
 
 /* rgerhards 2004-11-09: the following is a function that can be used
diff --git a/syslogd.h b/syslogd.h
index 43a95ae5..74ed6630 100644
--- a/syslogd.h
+++ b/syslogd.h
@@ -55,7 +55,9 @@ void logerrorVar(char *fmt, ...) __attribute__((format(printf, 1, 2)));
 void logerrorSz(char *type, char *errMsg);
 void logerrorInt(char *type, int iErr);
 
-void printchopped(char *hname, char *msg, int len, int fd, int iSourceType);
+#define MSG_PARSE_HOSTNAME 1
+#define MSG_DONT_PARSE_HOSTNAME 0
+rsRetVal parseAndSubmitMessage(char *hname, char *msg, int len, int bParseHost);
 int isAllowedSender(struct AllowedSenders *pAllowRoot, struct sockaddr *pFrom, const char *pszFromHost);
 void getCurrTime(struct syslogTime *t);
 int formatTimestampToMySQL(struct syslogTime *ts, char* pDst, size_t iLenDst);
diff --git a/tcpsyslog.c b/tcpsyslog.c
index f8620e38..c02d44fc 100644
--- a/tcpsyslog.c
+++ b/tcpsyslog.c
@@ -564,8 +564,8 @@ void TCPSessPrepareClose(int iTCPSess)
 		 * this case.
 		 */
 		dbgprintf("Extra data at end of stream in legacy syslog/tcp message - processing\n");
-		printchopped(pTCPSessions[iTCPSess].fromHost, pTCPSessions[iTCPSess].msg,
-			     pTCPSessions[iTCPSess].iMsg, pTCPSessions[iTCPSess].sock, 1);
+		parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pTCPSessions[iTCPSess].msg,
+			              pTCPSessions[iTCPSess].iMsg, MSG_PARSE_HOSTNAME);
 		pTCPSessions[iTCPSess].bAtStrtOfFram = 1;
 	}
 }
@@ -703,8 +703,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen)
 			/* emergency, we now need to flush, no matter if
 			 * we are at end of message or not...
 			 */
-			printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg,
-			 	     pTCPSessions[iTCPSess].sock, 1);
+			parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME);
 			iMsg = 0;
 			/* we might think if it is better to ignore the rest of the
 		 	 * message than to treat it as a new one. Maybe this is a good
@@ -715,8 +714,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen)
 
 		if(*pData == '\n' &&
 		   pTCPSessions[iTCPSess].eFraming == TCP_FRAMING_OCTET_STUFFING) { /* record delemiter? */
-			printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg,
-				     pTCPSessions[iTCPSess].sock, 1);
+			parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME);
 			iMsg = 0;
 			pTCPSessions[iTCPSess].bAtStrtOfFram = 1;
 			++pData;
@@ -730,8 +728,7 @@ int TCPSessDataRcvd(int iTCPSess, char *pData, int iLen)
 			pTCPSessions[iTCPSess].iOctetsRemain--;
 			if(pTCPSessions[iTCPSess].iOctetsRemain < 1) {
 				/* we have end of frame! */
-				printchopped(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg,
-					     pTCPSessions[iTCPSess].sock, 1);
+				parseAndSubmitMessage(pTCPSessions[iTCPSess].fromHost, pMsg, iMsg, MSG_PARSE_HOSTNAME);
 				iMsg = 0;
 				pTCPSessions[iTCPSess].bAtStrtOfFram = 1;
 			}