change log updated
[public/netxms.git] / include / nxlpapi.h
1 /*
2 ** NetXMS - Network Management System
3 ** Log Parsing Library
4 ** Copyright (C) 2003-2012 Victor Kirhenshtein
5 **
6 ** This program is free software; you can redistribute it and/or modify
7 ** it under the terms of the GNU Lesser General Public License as published by
8 ** the Free Software Foundation; either version 3 of the License, or
9 ** (at your option) any later version.
10 **
11 ** This program is distributed in the hope that it will be useful,
12 ** but WITHOUT ANY WARRANTY; without even the implied warranty of
13 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 ** GNU General Public License for more details.
15 **
16 ** You should have received a copy of the GNU Lesser General Public License
17 ** along with this program; if not, write to the Free Software
18 ** Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 **
20 ** File: nxlpapi.h
21 **
22 **/
23
24 #ifndef _nxlpapi_h_
25 #define _nxlpapi_h_
26
27 #ifdef _WIN32
28 #ifdef LIBNXLP_EXPORTS
29 #define LIBNXLP_EXPORTABLE __declspec(dllexport)
30 #else
31 #define LIBNXLP_EXPORTABLE __declspec(dllimport)
32 #endif
33 #else /* _WIN32 */
34 #define LIBNXLP_EXPORTABLE
35 #endif
36
37 #include <netxms-regex.h>
38 #include <nms_util.h>
39
40 /**
41 * Parser status
42 */
43 enum LogParserStatus
44 {
45 LPS_INIT = 0,
46 LPS_RUNNING = 1,
47 LPS_NO_FILE = 2,
48 LPS_OPEN_ERROR = 3,
49 LPS_SUSPENDED = 4,
50 LPS_EVT_SUBSCRIBE_ERROR = 5,
51 LPS_EVT_READ_ERROR = 6,
52 LPS_EVT_OPEN_ERROR = 7,
53 LPS_VSS_FAILURE = 8
54 };
55
56 /**
57 * Context actions
58 */
59 enum LogParserContextAction
60 {
61 CONTEXT_SET_MANUAL = 0,
62 CONTEXT_SET_AUTOMATIC = 1,
63 CONTEXT_CLEAR = 2
64 };
65
66 /**
67 * File encoding
68 */
69 enum LogParserFileEncoding
70 {
71 LP_FCP_AUTO = -1,
72 LP_FCP_ACP = 0,
73 LP_FCP_UTF8 = 1,
74 LP_FCP_UCS2 = 2,
75 LP_FCP_UCS2_LE = 3,
76 LP_FCP_UCS2_BE = 4,
77 LP_FCP_UCS4 = 5,
78 LP_FCP_UCS4_LE = 6,
79 LP_FCP_UCS4_BE = 7
80 };
81
82 /**
83 * Log parser callback
84 * Parameters:
85 * NetXMS event code, NetXMS event name, original text, source,
86 * original event ID (facility), original severity,
87 * number of capture groups, list of capture groups,
88 * object id, user arg
89 */
90 typedef void (* LogParserCallback)(UINT32, const TCHAR *, const TCHAR *, const TCHAR *, UINT32, UINT32, int, TCHAR **, UINT32, int, void *);
91
92 class LIBNXLP_EXPORTABLE LogParser;
93
94 #ifdef _WIN32
95
96 /**
97 * Snapshot handle
98 */
99 struct FileSnapshot
100 {
101 void *handle;
102 TCHAR *name;
103 };
104
105 #endif
106
107 /**
108 * Per object rule statistics
109 */
110 struct ObjectRuleStats
111 {
112 int checkCount;
113 int matchCount;
114 };
115
116 /**
117 * Log parser rule
118 */
119 class LIBNXLP_EXPORTABLE LogParserRule
120 {
121 friend class LogParser;
122
123 private:
124 LogParser *m_parser;
125 TCHAR *m_name;
126 regex_t m_preg;
127 UINT32 m_eventCode;
128 TCHAR *m_eventName;
129 bool m_isValid;
130 int m_numParams;
131 regmatch_t *m_pmatch;
132 TCHAR *m_regexp;
133 TCHAR *m_source;
134 UINT32 m_level;
135 UINT32 m_idStart;
136 UINT32 m_idEnd;
137 TCHAR *m_context;
138 int m_contextAction;
139 TCHAR *m_contextToChange;
140 bool m_isInverted;
141 bool m_breakOnMatch;
142 TCHAR *m_description;
143 int m_repeatInterval;
144 int m_repeatCount;
145 IntegerArray<time_t> *m_matchArray;
146 bool m_resetRepeat;
147 int m_checkCount;
148 int m_matchCount;
149 HashMap<UINT32, ObjectRuleStats> *m_objectCounters;
150
151 bool matchInternal(bool extMode, const TCHAR *source, UINT32 eventId, UINT32 level,
152 const TCHAR *line, LogParserCallback cb, UINT32 objectId, void *userArg);
153 bool matchRepeatCount();
154 void expandMacros(const TCHAR *regexp, String &out);
155 void incCheckCount(UINT32 objectId);
156 void incMatchCount(UINT32 objectId);
157
158 public:
159 LogParserRule(LogParser *parser, const TCHAR *name,
160 const TCHAR *regexp, UINT32 eventCode = 0, const TCHAR *eventName = NULL,
161 int numParams = 0, int repeatInterval = 0, int repeatCount = 0,
162 bool resetRepeat = true, const TCHAR *source = NULL, UINT32 level = 0xFFFFFFFF,
163 UINT32 idStart = 0, UINT32 idEnd = 0xFFFFFFFF);
164 LogParserRule(LogParserRule *src, LogParser *parser);
165 ~LogParserRule();
166
167 const TCHAR *getName() const { return m_name; }
168 bool isValid() const { return m_isValid; }
169
170 bool match(const TCHAR *line, LogParserCallback cb, UINT32 objectId, void *userArg);
171 bool matchEx(const TCHAR *source, UINT32 eventId, UINT32 level,
172 const TCHAR *line, LogParserCallback cb, UINT32 objectId, void *userArg);
173
174 void setContext(const TCHAR *context) { safe_free(m_context); m_context = (context != NULL) ? _tcsdup(context) : NULL; }
175 void setContextToChange(const TCHAR *context) { safe_free(m_contextToChange); m_contextToChange = (context != NULL) ? _tcsdup(context) : NULL; }
176 void setContextAction(int action) { m_contextAction = action; }
177
178 void setInverted(bool flag) { m_isInverted = flag; }
179 bool isInverted() const { return m_isInverted; }
180
181 void setBreakFlag(bool flag) { m_breakOnMatch = flag; }
182 bool getBreakFlag() const { return m_breakOnMatch; }
183
184 const TCHAR *getContext() const { return m_context; }
185 const TCHAR *getContextToChange() const { return m_contextToChange; }
186 int getContextAction() const { return m_contextAction; }
187
188 void setDescription(const TCHAR *descr) { safe_free(m_description); m_description = (descr != NULL) ? _tcsdup(descr) : NULL; }
189 const TCHAR *getDescription() const { return CHECK_NULL_EX(m_description); }
190
191 void setSource(const TCHAR *source) { safe_free(m_source); m_source = (source != NULL) ? _tcsdup(source) : NULL; }
192 const TCHAR *getSource() const { return CHECK_NULL_EX(m_source); }
193
194 void setLevel(UINT32 level) { m_level = level; }
195 UINT32 getLevel() const { return m_level; }
196
197 void setIdRange(UINT32 start, UINT32 end) { m_idStart = start; m_idEnd = end; }
198 QWORD getIdRange() const { return ((QWORD)m_idStart << 32) | (QWORD)m_idEnd; }
199
200 void setRepeatInterval(int repeatInterval) { m_repeatInterval = repeatInterval; }
201 int getRepeatInterval() const { return m_repeatInterval; }
202
203 void setRepeatCount(int repeatCount) { m_repeatCount = repeatCount; }
204 int getRepeatCount() const { return m_repeatCount; }
205
206 void setRepeatReset(bool resetRepeat) { m_resetRepeat = resetRepeat; }
207 bool isRepeatReset() const { return m_resetRepeat; }
208
209 const TCHAR *getRegexpSource() const { return CHECK_NULL(m_regexp); }
210
211 int getCheckCount(UINT32 objectId = 0) const;
212 int getMatchCount(UINT32 objectId = 0) const;
213
214 void restoreCounters(const LogParserRule *rule);
215 };
216
217 /**
218 * Log parser class
219 */
220 class LIBNXLP_EXPORTABLE LogParser
221 {
222 friend bool LogParserRule::matchInternal(bool, const TCHAR *, UINT32, UINT32, const TCHAR *, LogParserCallback, UINT32, void *);
223
224 private:
225 ObjectArray<LogParserRule> *m_rules;
226 StringMap m_contexts;
227 StringMap m_macros;
228 LogParserCallback m_cb;
229 void *m_userArg;
230 TCHAR *m_fileName;
231 int m_fileEncoding;
232 bool m_preallocatedFile;
233 StringList m_exclusionSchedules;
234 TCHAR *m_name;
235 CODE_TO_TEXT *m_eventNameList;
236 bool (*m_eventResolver)(const TCHAR *, UINT32 *);
237 THREAD m_thread; // Associated thread
238 int m_recordsProcessed;
239 int m_recordsMatched;
240 bool m_processAllRules;
241 bool m_suspended;
242 int m_traceLevel;
243 void (*m_traceCallback)(int, const TCHAR *, va_list);
244 LogParserStatus m_status;
245 #ifdef _WIN32
246 TCHAR *m_marker;
247 bool m_useSnapshot;
248 #endif
249
250 const TCHAR *checkContext(LogParserRule *rule);
251 void trace(int level, const TCHAR *format, ...);
252 bool matchLogRecord(bool hasAttributes, const TCHAR *source, UINT32 eventId, UINT32 level, const TCHAR *line, UINT32 objectId);
253
254 bool isExclusionPeriod();
255
256 const LogParserRule *findRuleByName(const TCHAR *name) const;
257
258 int getCharSize() const;
259
260 void setStatus(LogParserStatus status) { m_status = status; }
261
262 #ifdef _WIN32
263 void parseEvent(EVENTLOGRECORD *rec);
264
265 bool monitorFileWithSnapshot(CONDITION stopCondition, bool readFromCurrPos);
266 bool monitorEventLogV6(CONDITION stopCondition);
267 bool monitorEventLogV4(CONDITION stopCondition);
268
269 time_t readLastProcessedRecordTimestamp();
270 #endif
271
272 public:
273 LogParser();
274 LogParser(const LogParser *src);
275 ~LogParser();
276
277 static ObjectArray<LogParser> *createFromXml(const char *xml, int xmlLen = -1,
278 TCHAR *errorText = NULL, int errBufSize = 0, bool (*eventResolver)(const TCHAR *, UINT32 *) = NULL);
279
280 const TCHAR *getName() const { return m_name; }
281 const TCHAR *getFileName() const { return m_fileName; }
282 int getFileEncoding() const { return m_fileEncoding; }
283 LogParserStatus getStatus() const { return m_status; }
284 const TCHAR *getStatusText() const;
285 bool isFilePreallocated() const { return m_preallocatedFile; }
286
287 void setName(const TCHAR *name);
288 void setFileName(const TCHAR *name);
289
290 void setThread(THREAD th) { m_thread = th; }
291 THREAD getThread() { return m_thread; }
292
293 void setProcessAllFlag(bool flag) { m_processAllRules = flag; }
294 bool getProcessAllFlag() { return m_processAllRules; }
295
296 #ifdef _WIN32
297 void setSnapshotMode(bool enable) { m_useSnapshot = enable; }
298 bool isSnapshotMode() const { return m_useSnapshot; }
299 #endif
300
301 bool addRule(const TCHAR *regexp, UINT32 eventCode = 0, const TCHAR *eventName = NULL, int numParams = 0, int repeatInterval = 0, int repeatCount = 0, bool resetRepeat = true);
302 bool addRule(LogParserRule *rule);
303 void setCallback(LogParserCallback cb) { m_cb = cb; }
304 void setUserArg(void *arg) { m_userArg = arg; }
305 void setEventNameList(CODE_TO_TEXT *ctt) { m_eventNameList = ctt; }
306 void setEventNameResolver(bool (*cb)(const TCHAR *, UINT32 *)) { m_eventResolver = cb; }
307 UINT32 resolveEventName(const TCHAR *name, UINT32 defVal = 0);
308
309 void addExclusionSchedule(const TCHAR *schedule) { m_exclusionSchedules.add(schedule); }
310
311 void addMacro(const TCHAR *name, const TCHAR *value);
312 const TCHAR *getMacro(const TCHAR *name);
313
314 bool matchLine(const TCHAR *line, UINT32 objectId = 0);
315 bool matchEvent(const TCHAR *source, UINT32 eventId, UINT32 level, const TCHAR *line, UINT32 objectId = 0);
316
317 int getProcessedRecordsCount() const { return m_recordsProcessed; }
318 int getMatchedRecordsCount() const { return m_recordsMatched; }
319
320 int getTraceLevel() const { return m_traceLevel; }
321 void setTraceLevel(int level) { m_traceLevel = level; }
322 void setTraceCallback(void (*cb)(int, const TCHAR *, va_list)) { m_traceCallback = cb; }
323
324 bool monitorFile(CONDITION stopCondition, bool readFromCurrPos = true);
325 #ifdef _WIN32
326 bool monitorEventLog(CONDITION stopCondition, const TCHAR *markerPrefix);
327 void saveLastProcessedRecordTimestamp(time_t timestamp);
328 #endif
329
330 int getRuleCheckCount(const TCHAR *ruleName, UINT32 objectId = 0) const { const LogParserRule *r = findRuleByName(ruleName); return (r != NULL) ? r->getCheckCount(objectId) : -1; }
331 int getRuleMatchCount(const TCHAR *ruleName, UINT32 objectId = 0) const { const LogParserRule *r = findRuleByName(ruleName); return (r != NULL) ? r->getMatchCount(objectId) : -1; }
332
333 void restoreCounters(const LogParser *parser);
334
335 void suspend();
336 void resume();
337 };
338
339 /**
340 * Init log parser library
341 */
342 void LIBNXLP_EXPORTABLE InitLogParserLibrary();
343
344 /**
345 * Cleanup event log parsig library
346 */
347 void LIBNXLP_EXPORTABLE CleanupLogParserLibrary();
348
349 /**
350 * Set trace callback for log parser library
351 */
352 void LIBNXLP_EXPORTABLE SetLogParserTraceCallback(void (* traceCallback)(int, const TCHAR *, va_list));
353
354 #ifdef _WIN32
355
356 /**
357 * Create file snapshot
358 */
359 FileSnapshot LIBNXLP_EXPORTABLE *CreateFileSnapshot(const TCHAR *path);
360
361 /**
362 * Destroy file snapshot
363 */
364 void LIBNXLP_EXPORTABLE DestroyFileSnapshot(FileSnapshot *snapshot);
365
366 #endif
367
368 #endif