journald: Map the PRIORITY field to CIM_RecordForLog.PerceivedSeverity

Records in journal may contain syslog-style priority value so let's use
them. Unfortunately mapping the particular values between syslog and CIM
classes is not linear, manual mapping is needed.

The LOG_ERR may also map to PerceivedSeverity = Major but it's kept on
Minor for the moment.

If no such information is provided by the Journal, the CIM property is
left unset for the particular record.

See e.g. http://schemas.dmtf.org/wbem/cim-html/2.34.0/CIM_RecordForLog.html
for valuemap description.

1 files changed, 39 insertions, 0 deletions

diff --git a/src/journald/instutil.c b/src/journald/instutil.c
index fe6ab7a..af29942 100644
--- a/src/journald/instutil.c
+++ b/src/journald/instutil.c
@@ -19,6 +19,7 @@
  */
 
 #include <errno.h>
+#include <syslog.h>
 #include <glib.h>
 
 #include "instutil.h"
@@ -113,6 +114,44 @@ int create_LMI_JournalLogRecord(sd_journal *j,
         g_free(d);
     }
 
+    /* Optional: PerceivedSeverity */
+    r = dup_journal_data(j, "PRIORITY", &d);
+    if (r >= 0 && d != NULL && strlen(d) > 0) {
+        char *conv_err = NULL;
+        long int i = strtol(d, &conv_err, 10);
+        g_free(d);
+        if (conv_err == NULL || *conv_err == '\0')
+            switch (i) {
+                case LOG_EMERG:
+                    /* 7 - Fatal/NonRecoverable should be used to indicate an error occurred,
+                     *     but it's too late to take remedial action. */
+                    LMI_JournalLogRecord_Set_PerceivedSeverity_Fatal_NonRecoverable(rec);
+                    break;
+                case LOG_ALERT:
+                case LOG_CRIT:
+                    /* 6 - Critical should be used to indicate action is needed NOW and the scope
+                     *     is broad (perhaps an imminent outage to a critical resource will result). */
+                    LMI_JournalLogRecord_Set_PerceivedSeverity_Critical(rec);
+                    break;
+                case LOG_ERR:
+                    /* 4 - Minor should be used to indicate action is needed, but the situation
+                     *     is not serious at this time. */
+                    LMI_JournalLogRecord_Set_PerceivedSeverity_Minor(rec);
+                    break;
+                case LOG_WARNING:
+                    /* 3 - Degraded/Warning should be used when its appropriate to let the user
+                     *     decide if action is needed. */
+                    LMI_JournalLogRecord_Set_PerceivedSeverity_Degraded_Warning(rec);
+                    break;
+                case LOG_NOTICE:
+                case LOG_INFO:
+                case LOG_DEBUG:
+                    /* 2 - Information */
+                    LMI_JournalLogRecord_Set_PerceivedSeverity_Information(rec);
+                    break;
+            }
+    }
+
     return 1;
 }