/*
** SellaNMS
** $Id: syslog.h,v 1.22 2005/05/15 05:21:17 sella Exp $
** Copyright (c) 2001-2005 Digital Genesis Software, LLC. All Rights Reserved.
** Released under the GPL Version 2 License.
** http://www.digitalgenesis.com
*/

#ifndef __DGS_MODULE_MONITOR_SYSLOG_H
#define __DGS_MODULE_MONITOR_SYSLOG_H

#ifdef HAVE_CONFIG_H
	#include "config.h"
#endif

#include "defaults.h"
#include "util.h"
#include "storagedata.h"
#include "policy_framework/policy_framework.h"
#include "../monitor.h"
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stl/queue>
#include <stl/utility>

#define MODULE_MONITOR_SYSLOG_PORT_DEFAULT 514
#define MODULE_MONITOR_SYSLOG_QUEUEDEPTH_DEFAULT 250
#define MODULE_MONITOR_SYSLOG_DUPHISTMAX_DEFAULT 25
#define MODULE_MONITOR_SYSLOG_DUPHISTAGE_DEFAULT 5
#define MODULE_MONITOR_SYSLOG_DUPFUZFACTOR_DEFAULT 25
#define MODULE_MONITOR_SYSLOG_EXITAFTER_DEFAULT 0
#define MODULE_MONITOR_SYSLOG_NEXTWARN_DEFAULT 60

/* NOTE: This module implements a RFC 3164 syslog collector. */

typedef queue<pair<string, string> > received_queue_t;
typedef struct {
	int priority;
	string header;
	string timestamp;
	string hostname;
	string msg;
	string tag;
	string pid;
	string content;
} syslog_t;

typedef struct {
	u_int32_t source;
	time_t timestamp;
	unsigned long signature;
} dup_hist_t;

class Syslog: public Monitor {
	public:
		Syslog();
		~Syslog();

	protected:

	private:
		virtual RESULT execute();
		virtual RESULT readConfig();
		virtual RESULT printConfig();

		bool suppressDuplicate(u_int32_t *source, char* msg, int n);

		static RESULT receive_thread(void *args);
		static RESULT storage_thread(void *args);

		unsigned int port;
		unsigned long queueDepth;
		uint32_t source;

		dup_hist_t *dupHist;
		unsigned long dupHistCur;
		unsigned long dupHistMax;
		unsigned long dupHistAge;
		unsigned long dupFuzFactor;
		unsigned long exitAfter;
		time_t nextWarning;

		received_queue_t syslog_queue;
		pthread_mutex_t syslog_mutex;
};

#endif

/*
** Local Variables:
** c-basic-offset: 3
** tab-width: 3
** End:
** vim600: fdm=marker
** vim: noet ts=3 sw=3
*/
