Exemplo n.º 1
0
        public static SyslogMessage Create(SyslogFacility facility, SyslogSeverity severity, string message)
        {
            SyslogMessage msg = new SyslogMessage();

            msg.Facility    = facility;
            msg.Severity    = severity;
            msg.TimeStamp   = DateTimeOffset.Now;
            msg.HostName    = Environment.MachineName;
            msg.MessageText = message;
            return(msg);
        }
Exemplo n.º 2
0
        public static SyslogMessage Create(string message)
        {
            SyslogMessage msg = new SyslogMessage();

            msg.Facility    = SyslogConstants.DefaultFacility;
            msg.Severity    = SyslogConstants.DefaultSeverity;
            msg.TimeStamp   = DateTimeOffset.Now;
            msg.HostName    = Environment.MachineName;
            msg.MessageText = message;
            return(msg);
        }
Exemplo n.º 3
0
        //called when data for any output pin is requested
        public void Evaluate(int spreadMax)
        {
            spreadMax = Max(FMessageIn.SliceCount,
                            FFacility.SliceCount,
                            FSeverity.SliceCount,
                            FHostname.SliceCount,
                            FAppName.SliceCount,
                            FProcId.SliceCount,
                            FMsgId.SliceCount,
                            FStructuredDataName.SliceCount,
                            FStructuredDataValue.SliceCount);

            //ResizeAndDispose will adjust the spread length and thereby call
            //the given constructor function for new slices and Dispose on old
            //slices.
            FStreamOut.ResizeAndDispose(spreadMax, () => new MemoryStream());

            for (int i = 0; i < spreadMax; i++)
            {
                if (FMessageIn.IsChanged ||
                    FFacility.IsChanged ||
                    FSeverity.IsChanged ||
                    FHostname.IsChanged ||
                    FAppName.IsChanged ||
                    FProcId.IsChanged ||
                    FMsgId.IsChanged /*||
                                      * FStructuredData.IsChanged*/)
                {
                    //create msg
                    SyslogMessage msg = Create(FFacility[i], FSeverity[i], FMessageIn[i]);

                    // add properties
                    if (FHostname[i] != string.Empty)
                    {
                        msg.HostName = FHostname[i];
                    }
                    if (FAppName[i] != string.Empty)
                    {
                        msg.AppName = FAppName[i];
                    }
                    if (FProcId[i] != string.Empty)
                    {
                        msg.ProcessID = FProcId[i];
                    }
                    if (FMsgId[i] != string.Empty)
                    {
                        msg.MessageID = FMsgId[i];
                    }

                    // add structured Data
                    List <StructuredDataElement> sd  = new List <StructuredDataElement>();
                    StructuredDataElement        sde = new StructuredDataElement();
                    sde.ID = FSDID[0] + "@" + FEID[0];  // set id according to rfc5424 ... the enterprise ID is a wildcard anyway, since one is not registered at the IANA

                    for (int s = 0; s < FStructuredDataName[i].SliceCount; s++)
                    {
                        sde.Properties.Add(FStructuredDataName[i][s], FStructuredDataValue[i][s]);
                    }
                    sd.Add(sde);
                    msg.StructuredData = sd;

                    // convert to stream
                    byte[] byteMessage  = System.Text.Encoding.ASCII.GetBytes(msg.ToIetfSyslogString());
                    Stream outputStream = FStreamOut[i];

                    // write out
                    outputStream.Position = 0;
                    outputStream.SetLength(byteMessage.Length);
                    outputStream.Write(byteMessage, 0, byteMessage.Length);
                }
            }
            //this will force the changed flag of the output pin to be set
            FStreamOut.Flush(true);
        }
Exemplo n.º 4
0
        //List<Stream> oldStream;
        //bool firstrun = true;
        #endregion fields & pins

        public void Evaluate(int spreadMax)
        {
            FMessage.SliceCount             = spreadMax;
            FFacility.SliceCount            = spreadMax;
            FSeverity.SliceCount            = spreadMax;
            FTimestamp.SliceCount           = spreadMax;
            FHostname.SliceCount            = spreadMax;
            FAppName.SliceCount             = spreadMax;
            FProcId.SliceCount              = spreadMax;
            FMsgId.SliceCount               = spreadMax;
            FStructuredDataName.SliceCount  = spreadMax;
            FStructuredDataValue.SliceCount = spreadMax;

            #region test
            //if (firstrun)
            //    oldStream = new List<Stream>();

            //if (firstrun || oldStream.Count != FStreamIn.SliceCount)
            //{
            //    oldStream.Clear();

            //    foreach (Stream s in FStreamIn)
            //        oldStream.Add(s);
            //}
            #endregion test

            for (int i = 0; i < spreadMax; i++)
            {
                #region test
                //if (firstrun || oldStream[i] != FStreamIn[i]  )  //IsChanged doesn't work with Streams
                //{
                //    if (firstrun == true)
                //        firstrun = false;
                //    oldStream[i] = FStreamIn[i];
                #endregion test

                if (FStreamIn[i].Length > 0)
                {
                    // Stream > string
                    byte[] buffer        = new byte[FStreamIn[i].Length];
                    int    test          = FStreamIn[i].Read(buffer, 0, (int)FStreamIn[i].Length);
                    string stringMessage = System.Text.Encoding.ASCII.GetString(buffer, 0, buffer.Length);

                    SyslogParser  prs = new SyslogParser();
                    SyslogMessage msg = prs.Parse(stringMessage);

                    if (msg != null)
                    {
                        FMessage[i]   = msg.MessageText;
                        FFacility[i]  = msg.Facility;
                        FSeverity[i]  = msg.Severity;
                        FTimestamp[i] = msg.TimeStamp.ToString();
                        FHostname[i]  = msg.HostName;
                        FAppName[i]   = msg.AppName;
                        FProcId[i]    = msg.ProcessID;
                        FMsgId[i]     = msg.MessageID;

                        int sdCount = msg.StructuredData.Count; // is normally 1 (when created with Syslog (Raw join), because it can't pack several sd elements into one sd package)

                        FStructuredDataName[i].SliceCount  = 0;
                        FStructuredDataValue[i].SliceCount = 0;

                        for (int s = 0; s < sdCount; s++)
                        {
                            // each sd contains n sd elements
                            int keycount = msg.StructuredData[s].Properties.Count;

                            for (int k = 0; k < keycount; k++)
                            {
                                FStructuredDataName[i].Add <string>(msg.StructuredData[s].Properties.AllKeys[k]);
                                FStructuredDataValue[i].Add <string>(msg.StructuredData[s].Properties.GetValues(k)[0]);
                            }
                        }
                    }
                    else
                    {
                        FMessage[i]   = "corrupt message";
                        FFacility[i]  = SyslogFacility.Unknown;
                        FSeverity[i]  = SyslogSeverity.Unknown;
                        FTimestamp[i] = "";
                        FHostname[i]  = "";
                        FAppName[i]   = "";
                        FProcId[i]    = "";
                        FMsgId[i]     = "";
                        FStructuredDataName[i].SliceCount  = 0;
                        FStructuredDataValue[i].SliceCount = 0;
                    }
                }
            }
        }