/*
** SellaNMS
** $Id: syslog.h,v 1.14 2006/01/24 07:08:10 sella Exp $
** Copyright (c) 2001-2005 Digital Genesis Software, LLC. All Rights Reserved.
** Released under the GPL Version 2 License.
** http://www.digitalgenesis.com
*/

#ifndef __DGS_MONITOR_SYSLOG_H
#define __DGS_MONITOR_SYSLOG_H

#ifdef HAVE_CONFIG_H
	#include "config.h"
#endif

#include "defaults.h"
#include "common/util.h"
#include "common/rate.h"
#include "storage/storagedata.h"
#include "policy_framework/policy_framework.h"
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stl/queue>
#include <stl/utility>

#define MONITOR_SYSLOG_PORT_DEF				514
#define MONITOR_SYSLOG_QUEUEDEPTH_DEF		1000
#define MONITOR_SYSLOG_QUEUEDEPTH_MIN		50
#define MONITOR_SYSLOG_QUEUEDEPTH_MAX		64000
#define MONITOR_SYSLOG_DUPHISTMAX_DEF		25
#define MONITOR_SYSLOG_DUPHISTAGE_DEF		5
#define MONITOR_SYSLOG_DUPFUZFACTOR_DEF	25
#define MONITOR_SYSLOG_EXITAFTER_DEF		0
#define MONITOR_SYSLOG_NEXTWARN_DEF			60
#define MONITOR_SYSLOG_RATEINTERVAL_DEF	RATE_INTERVAL_DEF /* From common/rate.h */
#define MONITOR_SYSLOG_RATEINTERVAL_MIN	0
#define MONITOR_SYSLOG_RATEINTERVAL_MAX	3600
#define MONITOR_SYSLOG_RATECLEAN_DEF		RATE_CLEAN_DEF /* From common/rate.h */
#define MONITOR_SYSLOG_RATECLEAN_MIN		1
#define MONITOR_SYSLOG_RATECLEAN_MAX		64000

/* NOTE: This module implements a RFC 3164 syslog collector. */

typedef queue<pair<string, string> > received_queue_t;
typedef struct {
	int priority;
	string header;
	string timestamp;
	string hostname;
	string msg;
	string tag;
	string pid;
	string content;
} syslog_t;

typedef struct {
	u_int32_t source;
	time_t timestamp;
	unsigned long signature;
} dup_hist_t;

class Syslog {
	public:
		Syslog();
		~Syslog();
		virtual RESULT execute();
		virtual RESULT readConfig();

	protected:

	private:
		virtual void printConfig();

		bool suppressDuplicate(u_int32_t *source, char* msg, int n);

		static RESULT receive_thread(void *args);
		static RESULT policy_thread(void *args);

		unsigned int port;
		unsigned long queueDepth;
		uint32_t source;

		dup_hist_t *dupHist;
		unsigned long dupHistCur;
		unsigned long dupHistMax;
		unsigned long dupHistAge;
		unsigned long dupFuzFactor;
		unsigned long exitAfter;
		unsigned long rateInterval;
		unsigned long rateClean;
		time_t nextWarning;

		int syslog_flag[2];

		received_queue_t syslog_queue;
		pthread_mutex_t syslog_mutex;

		PolicyFramework inputPolicy;
		PolicyFramework outputPolicy;

		Storage storage;
		Rate rate;
};

#endif

/*
** Local Variables:
** c-basic-offset: 3
** tab-width: 3
** End:
** vim:
** vim: noet ts=3 sw=3
*/
