bool IFilter.IsMatch(SyslogMessage message) { SyslogAttributes attrs = message.GetAdvancedAttributes(); if (Host != null) { if (Host != (message.Host ?? string.Empty)) { return(false); } } if (Process != null) { if (Process != (message.ProcessID ?? string.Empty)) { return(false); } } if (Logger != null) { if (Logger != (attrs.LogName ?? string.Empty)) { return(false); } } if (Module != null) { if (Module != (attrs.ModuleName ?? string.Empty)) { return(false); } } if (Class != null) { if (Class != (attrs.ClassName ?? string.Empty)) { return(false); } } if (Method != null) { if (Method != (attrs.MethodName ?? string.Empty)) { return(false); } } if (FfdaOnly) { return((message.MessageId == "FFDA" && message.Severity == SyslogSeverity.Info) || (message.MessageId == "HEARTBEAT" && message.Severity == SyslogSeverity.Debug)); } return(true); }
static void client_MessageReceived(object sender, SyslogMessageEventArgs e) { SyslogAttributes attrs = e.Message.GetAdvancedAttributes(); Console.WriteLine("Got heartbeat from ({0}|{1}|{2})", e.Message.Host, e.Message.ProcessID ?? e.Message.ApplicationName, attrs.LogName); }
private string GetQuery(SyslogMessage message) { List <string> criteria = new List <string>(3); SyslogAttributes attrs = message.GetAdvancedAttributes(); foreach (DataColumn column in _primaryKey.Columns) { string colName = null, value = null; if (column == _colHost) { colName = _colHost.ColumnName; value = message.Host; } else if (column == _colProc) { colName = _colProc.ColumnName; value = message.ProcessID ?? message.ApplicationName; } else if (column == _colLogger) { colName = _colLogger.ColumnName; value = attrs.LogName; } else if (column == _colModule) { colName = _colModule.ColumnName; value = attrs.ModuleName; } else if (column == _colClass) { colName = _colClass.ColumnName; value = attrs.ClassName; } else if (column == _colMethod) { colName = _colMethod.ColumnName; value = attrs.MethodName; } criteria.Add(string.Format("{0} = '{1}'", colName, value)); } return(string.Join(" AND ", criteria.ToArray())); }
/// <summary> /// Initializes a new instance of FFDAInformation /// </summary> /// <param name="message">Syslog message to analyze</param> /// <exception cref="System.InvalidOperationException">Message is not FFDA</exception> public FieldFailureDataInformation(SyslogMessage message) { try { if (message.MessageId == "FFDA" && message.Severity == SyslogSeverity.Info) { string txt = message.Text; if (txt == null) { throw new InvalidOperationException("Message is not FFD"); } SyslogAttributes advancedAttrs = message.GetAdvancedAttributes(); Host = message.Host; Process = message.ProcessID ?? message.ApplicationName; Logger = advancedAttrs.LogName; string prefix = txt.Substring(0, 3); if (txt.Contains("-") && txt.Length > 4) { FlowId = txt.Substring(4); } Event = (FieldFailureEvent)Enum.Parse(typeof(FieldFailureEvent), prefix.ToUpper()); } } catch (InvalidOperationException) { throw; } catch (Exception ex) { throw new InvalidOperationException("Message is not FFD", ex); } }
private void WorkerLoop() { try { while (true) { SyslogMessage message = _messageQueue.Dequeue(); //if (message.Facility == SyslogFacility.Internally) continue; //Redundant SyslogAttributes attrs = message.GetAdvancedAttributes(); DateTime? lastHb = null; string host = message.Host ?? "", process = message.ProcessID ?? message.ApplicationName ?? "", logger = attrs.LogName ?? ""; bool ffda = message.MessageId == "FFDA"; if (message.MessageId == "HEARTBEAT" && message.Severity == SyslogSeverity.Debug) { lastHb = message.Timestamp; } try { string entityName = null; //Suppress error about missing initialization try { DataRow newRow = _entityTable.Rows.Add( host, process, logger, message.ApplicationName ?? "", ffda, message.Timestamp, lastHb, DBNull.Value, DBNull.Value ); entityName = GetEntityName(newRow); Log.Debug("Acquired new entity: {0}, {1}FFDA-enabled", entityName, ffda ? "" : "not "); //Now creating channel for new entity IFilter entityFilter = new EntityFilter(host, process, logger); string description = string.Format("Channel monitoring logs from entity {0}", entityName); do { string randomChannelId = "em_" + Randomizer.RandomAlphanumericString(15); try { _logbus.CreateChannel(randomChannelId, "EntityManager auto-generated", entityFilter, description, 0); //Edit row accordingly newRow[_colChannelId] = randomChannelId; break; } catch (LogbusException) //Duplicate channel ID { continue; } } //Not necessarily a poor choice. With 15 chars we have billions of opportunities. //In a real system, we can't have more than thousands of entities. This algorithm //might go into stall only if randomizer is not "random" enough while (true); if (ffda) //Create FFDA channel too { entityFilter = new EntityFilter(host, process, logger, true); description = string.Format("Channel monitoring FFDA logs from entity {0}", entityName); do { string randomChannelId = "em_" + Randomizer.RandomAlphanumericString(15); try { _logbus.CreateChannel(randomChannelId, "EntityManager auto-generated", entityFilter, description, 0); //Edit row accordingly newRow[_colFfdaChannelId] = randomChannelId; break; } catch (LogbusException) //Duplicate channel ID { continue; } } //Like above while (true); } } catch (ConstraintException) { //We suppose we are trying to insert a duplicate primary key, then now we switch to update DataRow existingRow = _entityTable.Select(GetQuery(message))[0]; bool oldFfda = (bool)existingRow[_colFfda]; existingRow.BeginEdit(); existingRow[_colFfda] = ffda | oldFfda; if (lastHb != null) { existingRow[_colLastHeartbeat] = message.Timestamp; } else { existingRow[_colLastAction] = message.Timestamp; } existingRow.EndEdit(); if (ffda && !oldFfda) { Log.Debug("Entity {0} is now FFDA-enabled", entityName); //Create FFDA channel IFilter entityFilter = new EntityFilter(host, process, logger, true); string description = string.Format("Channel monitoring FFDA logs from entity {0}", entityName); do { string randomChannelId = "em_" + Randomizer.RandomAlphanumericString(15); try { _logbus.CreateChannel(randomChannelId, "EntityManager auto-generated", entityFilter, description, 0); //Edit row accordingly existingRow[_colFfdaChannelId] = randomChannelId; break; } catch (LogbusException) //Duplicate channel ID { continue; } } //Like above while (true); } } } catch (ThreadAbortException) { throw; } catch (Exception ex) { Log.Error("Unable to add an entity row into the data table"); Log.Debug(string.Format("Error details: {0}", ex.Message)); } } } catch (ThreadAbortException) { } }