bool IFilter.IsMatch(SyslogMessage message)
{
SyslogAttributes attrs = message.GetAdvancedAttributes();
if (Host != null)
{
if (Host != (message.Host ?? string.Empty))
{
return(false);
}
}
if (Process != null)
{
if (Process != (message.ProcessID ?? string.Empty))
{
return(false);
}
}
if (Logger != null)
{
if (Logger != (attrs.LogName ?? string.Empty))
{
return(false);
}
}
if (Module != null)
{
if (Module != (attrs.ModuleName ?? string.Empty))
{
return(false);
}
}
if (Class != null)
{
if (Class != (attrs.ClassName ?? string.Empty))
{
return(false);
}
}
if (Method != null)
{
if (Method != (attrs.MethodName ?? string.Empty))
{
return(false);
}
}
if (FfdaOnly)
{
return((message.MessageId == "FFDA" && message.Severity == SyslogSeverity.Info) ||
(message.MessageId == "HEARTBEAT" && message.Severity == SyslogSeverity.Debug));
}
return(true);
}
static void client_MessageReceived(object sender, SyslogMessageEventArgs e)
{
SyslogAttributes attrs = e.Message.GetAdvancedAttributes();
Console.WriteLine("Got heartbeat from ({0}|{1}|{2})", e.Message.Host,
e.Message.ProcessID ?? e.Message.ApplicationName, attrs.LogName);
}
private string GetQuery(SyslogMessage message)
{
List <string> criteria = new List <string>(3);
SyslogAttributes attrs = message.GetAdvancedAttributes();
foreach (DataColumn column in _primaryKey.Columns)
{
string colName = null, value = null;
if (column == _colHost)
{
colName = _colHost.ColumnName;
value = message.Host;
}
else if (column == _colProc)
{
colName = _colProc.ColumnName;
value = message.ProcessID ?? message.ApplicationName;
}
else if (column == _colLogger)
{
colName = _colLogger.ColumnName;
value = attrs.LogName;
}
else if (column == _colModule)
{
colName = _colModule.ColumnName;
value = attrs.ModuleName;
}
else if (column == _colClass)
{
colName = _colClass.ColumnName;
value = attrs.ClassName;
}
else if (column == _colMethod)
{
colName = _colMethod.ColumnName;
value = attrs.MethodName;
}
criteria.Add(string.Format("{0} = '{1}'", colName, value));
}
return(string.Join(" AND ", criteria.ToArray()));
}
/// <summary>
/// Initializes a new instance of FFDAInformation
/// </summary>
/// <param name="message">Syslog message to analyze</param>
/// <exception cref="System.InvalidOperationException">Message is not FFDA</exception>
public FieldFailureDataInformation(SyslogMessage message)
{
try
{
if (message.MessageId == "FFDA" && message.Severity == SyslogSeverity.Info)
{
string txt = message.Text;
if (txt == null)
{
throw new InvalidOperationException("Message is not FFD");
}
SyslogAttributes advancedAttrs = message.GetAdvancedAttributes();
Host = message.Host;
Process = message.ProcessID ?? message.ApplicationName;
Logger = advancedAttrs.LogName;
string prefix = txt.Substring(0, 3);
if (txt.Contains("-") && txt.Length > 4)
{
FlowId = txt.Substring(4);
}
Event = (FieldFailureEvent)Enum.Parse(typeof(FieldFailureEvent), prefix.ToUpper());
}
}
catch (InvalidOperationException)
{
throw;
}
catch (Exception ex)
{
throw new InvalidOperationException("Message is not FFD", ex);
}
}
private void WorkerLoop()
{
try
{
while (true)
{
SyslogMessage message = _messageQueue.Dequeue();
//if (message.Facility == SyslogFacility.Internally) continue; //Redundant
SyslogAttributes attrs = message.GetAdvancedAttributes();
DateTime? lastHb = null;
string host = message.Host ?? "",
process = message.ProcessID ?? message.ApplicationName ?? "",
logger = attrs.LogName ?? "";
bool ffda = message.MessageId == "FFDA";
if (message.MessageId == "HEARTBEAT" && message.Severity == SyslogSeverity.Debug)
{
lastHb = message.Timestamp;
}
try
{
string entityName = null; //Suppress error about missing initialization
try
{
DataRow newRow = _entityTable.Rows.Add(
host,
process,
logger,
message.ApplicationName ?? "",
ffda,
message.Timestamp,
lastHb,
DBNull.Value,
DBNull.Value
);
entityName = GetEntityName(newRow);
Log.Debug("Acquired new entity: {0}, {1}FFDA-enabled",
entityName,
ffda ? "" : "not ");
//Now creating channel for new entity
IFilter entityFilter = new EntityFilter(host, process, logger);
string description = string.Format("Channel monitoring logs from entity {0}",
entityName);
do
{
string randomChannelId = "em_" + Randomizer.RandomAlphanumericString(15);
try
{
_logbus.CreateChannel(randomChannelId, "EntityManager auto-generated", entityFilter,
description, 0);
//Edit row accordingly
newRow[_colChannelId] = randomChannelId;
break;
}
catch (LogbusException) //Duplicate channel ID
{
continue;
}
} //Not necessarily a poor choice. With 15 chars we have billions of opportunities.
//In a real system, we can't have more than thousands of entities. This algorithm
//might go into stall only if randomizer is not "random" enough
while (true);
if (ffda) //Create FFDA channel too
{
entityFilter = new EntityFilter(host, process, logger, true);
description = string.Format("Channel monitoring FFDA logs from entity {0}",
entityName);
do
{
string randomChannelId = "em_" + Randomizer.RandomAlphanumericString(15);
try
{
_logbus.CreateChannel(randomChannelId, "EntityManager auto-generated",
entityFilter,
description, 0);
//Edit row accordingly
newRow[_colFfdaChannelId] = randomChannelId;
break;
}
catch (LogbusException) //Duplicate channel ID
{
continue;
}
} //Like above
while (true);
}
}
catch (ConstraintException)
{
//We suppose we are trying to insert a duplicate primary key, then now we switch to update
DataRow existingRow = _entityTable.Select(GetQuery(message))[0];
bool oldFfda = (bool)existingRow[_colFfda];
existingRow.BeginEdit();
existingRow[_colFfda] = ffda | oldFfda;
if (lastHb != null)
{
existingRow[_colLastHeartbeat] = message.Timestamp;
}
else
{
existingRow[_colLastAction] = message.Timestamp;
}
existingRow.EndEdit();
if (ffda && !oldFfda)
{
Log.Debug("Entity {0} is now FFDA-enabled",
entityName);
//Create FFDA channel
IFilter entityFilter = new EntityFilter(host, process, logger, true);
string description =
string.Format("Channel monitoring FFDA logs from entity {0}",
entityName);
do
{
string randomChannelId = "em_" + Randomizer.RandomAlphanumericString(15);
try
{
_logbus.CreateChannel(randomChannelId, "EntityManager auto-generated",
entityFilter,
description, 0);
//Edit row accordingly
existingRow[_colFfdaChannelId] = randomChannelId;
break;
}
catch (LogbusException) //Duplicate channel ID
{
continue;
}
} //Like above
while (true);
}
}
}
catch (ThreadAbortException)
{
throw;
}
catch (Exception ex)
{
Log.Error("Unable to add an entity row into the data table");
Log.Debug(string.Format("Error details: {0}", ex.Message));
}
}
}
catch (ThreadAbortException) { }
}
