added check and match counters in log parser rules
[public/netxms.git] / include / nxlpapi.h
1 /*
2 ** NetXMS - Network Management System
3 ** Log Parsing Library
4 ** Copyright (C) 2003-2012 Victor Kirhenshtein
5 **
6 ** This program is free software; you can redistribute it and/or modify
7 ** it under the terms of the GNU Lesser General Public License as published by
8 ** the Free Software Foundation; either version 3 of the License, or
9 ** (at your option) any later version.
10 **
11 ** This program is distributed in the hope that it will be useful,
12 ** but WITHOUT ANY WARRANTY; without even the implied warranty of
13 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 ** GNU General Public License for more details.
15 **
16 ** You should have received a copy of the GNU Lesser General Public License
17 ** along with this program; if not, write to the Free Software
18 ** Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 **
20 ** File: nxlpapi.h
21 **
22 **/
23
24 #ifndef _nxlpapi_h_
25 #define _nxlpapi_h_
26
27 #ifdef _WIN32
28 #ifdef LIBNXLP_EXPORTS
29 #define LIBNXLP_EXPORTABLE __declspec(dllexport)
30 #else
31 #define LIBNXLP_EXPORTABLE __declspec(dllimport)
32 #endif
33 #else /* _WIN32 */
34 #define LIBNXLP_EXPORTABLE
35 #endif
36
37 #include <netxms-regex.h>
38 #include <nms_util.h>
39
40
41 //
42 // Parser status
43 //
44
45 #define MAX_PARSER_STATUS_LEN 64
46
47 #define LPS_INIT _T("INIT")
48 #define LPS_RUNNING _T("RUNNING")
49 #define LPS_NO_FILE _T("FILE MISSING")
50 #define LPS_OPEN_ERROR _T("FILE OPEN ERROR")
51
52
53 //
54 // Context actions
55 //
56
57 #define CONTEXT_SET_MANUAL 0
58 #define CONTEXT_SET_AUTOMATIC 1
59 #define CONTEXT_CLEAR 2
60
61
62 //
63 // File encoding
64 //
65
66 #define LP_FCP_ACP 0
67 #define LP_FCP_UTF8 1
68 #define LP_FCP_UCS2 2
69 #define LP_FCP_UCS2_LE 3
70 #define LP_FCP_UCS4 4
71 #define LP_FCP_UCS4_LE 5
72
73 /**
74 * Log parser callback
75 * Parameters:
76 * NetXMS event code, NetXMS event name, original text, source,
77 * original event ID (facility), original severity,
78 * number of capture groups, list of capture groups,
79 * object id, user arg
80 */
81 typedef void (* LogParserCallback)(UINT32, const TCHAR *, const TCHAR *, const TCHAR *, UINT32, UINT32, int, TCHAR **, UINT32, int, void *);
82
83 class LIBNXLP_EXPORTABLE LogParser;
84
85 /**
86 * Log parser rule
87 */
88 class LIBNXLP_EXPORTABLE LogParserRule
89 {
90 friend class LogParser;
91
92 private:
93 LogParser *m_parser;
94 regex_t m_preg;
95 UINT32 m_eventCode;
96 TCHAR *m_eventName;
97 bool m_isValid;
98 int m_numParams;
99 regmatch_t *m_pmatch;
100 TCHAR *m_regexp;
101 TCHAR *m_source;
102 UINT32 m_level;
103 UINT32 m_idStart;
104 UINT32 m_idEnd;
105 TCHAR *m_context;
106 int m_contextAction;
107 TCHAR *m_contextToChange;
108 bool m_isInverted;
109 bool m_breakOnMatch;
110 TCHAR *m_description;
111 int m_repeatInterval;
112 int m_repeatCount;
113 IntegerArray<time_t> *m_matchArray;
114 bool m_resetRepeat;
115 UINT32 m_checkCount;
116 UINT32 m_matchCount;
117
118 bool matchInternal(bool extMode, const TCHAR *source, UINT32 eventId, UINT32 level,
119 const TCHAR *line, LogParserCallback cb, UINT32 objectId, void *userArg);
120 bool matchRepeatCount();
121 void expandMacros(const TCHAR *regexp, String &out);
122
123 public:
124 LogParserRule(LogParser *parser,
125 const TCHAR *regexp, UINT32 eventCode = 0, const TCHAR *eventName = NULL,
126 int numParams = 0, int repeatInterval = 0, int repeatCount = 0,
127 bool resetRepeat = true, const TCHAR *source = NULL, UINT32 level = 0xFFFFFFFF,
128 UINT32 idStart = 0, UINT32 idEnd = 0xFFFFFFFF);
129 LogParserRule(LogParserRule *src, LogParser *parser);
130 ~LogParserRule();
131
132 bool isValid() const { return m_isValid; }
133 bool match(const TCHAR *line, LogParserCallback cb, UINT32 objectId, void *userArg);
134 bool matchEx(const TCHAR *source, UINT32 eventId, UINT32 level,
135 const TCHAR *line, LogParserCallback cb, UINT32 objectId, void *userArg);
136
137 void setContext(const TCHAR *context) { safe_free(m_context); m_context = (context != NULL) ? _tcsdup(context) : NULL; }
138 void setContextToChange(const TCHAR *context) { safe_free(m_contextToChange); m_contextToChange = (context != NULL) ? _tcsdup(context) : NULL; }
139 void setContextAction(int action) { m_contextAction = action; }
140
141 void setInverted(bool flag) { m_isInverted = flag; }
142 BOOL isInverted() const { return m_isInverted; }
143
144 void setBreakFlag(bool flag) { m_breakOnMatch = flag; }
145 BOOL getBreakFlag() const { return m_breakOnMatch; }
146
147 const TCHAR *getContext() const { return m_context; }
148 const TCHAR *getContextToChange() const { return m_contextToChange; }
149 int getContextAction() const { return m_contextAction; }
150
151 void setDescription(const TCHAR *descr) { safe_free(m_description); m_description = (descr != NULL) ? _tcsdup(descr) : NULL; }
152 const TCHAR *getDescription() const { return CHECK_NULL_EX(m_description); }
153
154 void setSource(const TCHAR *source) { safe_free(m_source); m_source = (source != NULL) ? _tcsdup(source) : NULL; }
155 const TCHAR *getSource() const { return CHECK_NULL_EX(m_source); }
156
157 void setLevel(UINT32 level) { m_level = level; }
158 UINT32 getLevel() const { return m_level; }
159
160 void setIdRange(UINT32 start, UINT32 end) { m_idStart = start; m_idEnd = end; }
161 QWORD getIdRange() const { return ((QWORD)m_idStart << 32) | (QWORD)m_idEnd; }
162
163 void setRepeatInterval(int repeatInterval) { m_repeatInterval = repeatInterval; }
164 int getRepeatInterval() const { return m_repeatInterval; }
165
166 void setRepeatCount(int repeatCount) { m_repeatCount = repeatCount; }
167 int getRepeatCount() const { return m_repeatCount; }
168
169 void setRepeatReset(bool resetRepeat) { m_resetRepeat = resetRepeat; }
170 bool isRepeatReset() const { return m_resetRepeat; }
171
172 const TCHAR *getRegexpSource() const { return CHECK_NULL(m_regexp); }
173
174 UINT32 getCheckCount() const { return m_checkCount; }
175 UINT32 getMatchCount() const { return m_matchCount; }
176 };
177
178 /**
179 * Log parser class
180 */
181 class LIBNXLP_EXPORTABLE LogParser
182 {
183 friend bool LogParserRule::matchInternal(bool, const TCHAR *, UINT32, UINT32, const TCHAR *, LogParserCallback, UINT32, void *);
184
185 private:
186 int m_numRules;
187 LogParserRule **m_rules;
188 StringMap m_contexts;
189 StringMap m_macros;
190 LogParserCallback m_cb;
191 void *m_userArg;
192 TCHAR *m_fileName;
193 int m_fileEncoding;
194 TCHAR *m_name;
195 CODE_TO_TEXT *m_eventNameList;
196 bool (*m_eventResolver)(const TCHAR *, UINT32 *);
197 THREAD m_thread; // Associated thread
198 int m_recordsProcessed;
199 int m_recordsMatched;
200 bool m_processAllRules;
201 int m_traceLevel;
202 void (*m_traceCallback)(const TCHAR *, va_list);
203 TCHAR m_status[MAX_PARSER_STATUS_LEN];
204 #ifdef _WIN32
205 TCHAR *m_marker;
206 #endif
207
208 const TCHAR *checkContext(LogParserRule *rule);
209 void trace(int level, const TCHAR *format, ...);
210 bool matchLogRecord(bool hasAttributes, const TCHAR *source, UINT32 eventId, UINT32 level, const TCHAR *line, UINT32 objectId);
211
212 #ifdef _WIN32
213 void parseEvent(EVENTLOGRECORD *rec);
214
215 bool monitorEventLogV6(CONDITION stopCondition);
216 bool monitorEventLogV4(CONDITION stopCondition);
217
218 time_t readLastProcessedRecordTimestamp();
219 #endif
220
221 public:
222 LogParser();
223 LogParser(LogParser *src);
224 ~LogParser();
225
226 static ObjectArray<LogParser> *createFromXml(const char *xml, int xmlLen = -1,
227 TCHAR *errorText = NULL, int errBufSize = 0, bool (*eventResolver)(const TCHAR *, UINT32 *) = NULL);
228
229 void setFileName(const TCHAR *name);
230 const TCHAR *getFileName() { return m_fileName; }
231
232 void setFileEncoding(int encoding) { m_fileEncoding = encoding; }
233 int getFileEncoding() { return m_fileEncoding; }
234
235 void setName(const TCHAR *name);
236 const TCHAR *getName() { return m_name; }
237
238 void setStatus(const TCHAR *status) { nx_strncpy(m_status, status, MAX_PARSER_STATUS_LEN); }
239 const TCHAR *getStatus() { return m_status; }
240
241 void setThread(THREAD th) { m_thread = th; }
242 THREAD getThread() { return m_thread; }
243
244 void setProcessAllFlag(bool flag) { m_processAllRules = flag; }
245 bool getProcessAllFlag() { return m_processAllRules; }
246
247 bool addRule(const TCHAR *regexp, UINT32 eventCode = 0, const TCHAR *eventName = NULL, int numParams = 0, int repeatInterval = 0, int repeatCount = 0, bool resetRepeat = true);
248 bool addRule(LogParserRule *rule);
249 void setCallback(LogParserCallback cb) { m_cb = cb; }
250 void setUserArg(void *arg) { m_userArg = arg; }
251 void setEventNameList(CODE_TO_TEXT *ctt) { m_eventNameList = ctt; }
252 void setEventNameResolver(bool (*cb)(const TCHAR *, UINT32 *)) { m_eventResolver = cb; }
253 UINT32 resolveEventName(const TCHAR *name, UINT32 defVal = 0);
254
255 void addMacro(const TCHAR *name, const TCHAR *value);
256 const TCHAR *getMacro(const TCHAR *name);
257
258 bool matchLine(const TCHAR *line, UINT32 objectId = 0);
259 bool matchEvent(const TCHAR *source, UINT32 eventId, UINT32 level, const TCHAR *line, UINT32 objectId = 0);
260
261 int getProcessedRecordsCount() { return m_recordsProcessed; }
262 int getMatchedRecordsCount() { return m_recordsMatched; }
263
264 int getTraceLevel() { return m_traceLevel; }
265 void setTraceLevel(int level) { m_traceLevel = level; }
266 void setTraceCallback(void (*cb)(const TCHAR *, va_list)) { m_traceCallback = cb; }
267
268 bool monitorFile(CONDITION stopCondition, bool readFromCurrPos = true);
269 #ifdef _WIN32
270 bool monitorEventLog(CONDITION stopCondition, const TCHAR *markerPrefix);
271 void saveLastProcessedRecordTimestamp(time_t timestamp);
272 #endif
273 };
274
275 /**
276 * Init log parser library
277 */
278 void LIBNXLP_EXPORTABLE InitLogParserLibrary();
279
280 /**
281 * Cleanup event log parsig library
282 */
283 void LIBNXLP_EXPORTABLE CleanupLogParserLibrary();
284
285 /**
286 * Set trace callback for log parser library
287 */
288 void LIBNXLP_EXPORTABLE SetLogParserTraceCallback(void (* traceCallback)(int, const TCHAR *, va_list));
289
290 #endif