import.c

   1 #define _GNU_SOURCE 1
   2 #include <sys/types.h>
   3 #include <signal.h>
   4
   5 #include <nagios/broker.h>
   6 #include <nagios/nebcallbacks.h>
   7 #include "sql.h"
   8 #include "hooks.h"
   9 #include "logging.h"
  10 #include "hash.h"
  11 #include "lparse.h"
  12 #include "logutils.h"
  13
  14 #define IGNORE_LINE 0
  15
  16 #define CONCERNS_HOST 50
  17 #define CONCERNS_SERVICE 60
  18
  19 #define MAX_NVECS 16
  20 #define HASH_TABLE_SIZE 128
  21
  22 /* for some reason these aren't defined inside Nagios' headers */
  23 #define SERVICE_OK 0
  24 #define SERVICE_WARNING 1
  25 #define SERVICE_CRITICAL 2
  26 #define SERVICE_UNKNOWN 3
  27
  28 #define PROGRESS_INTERVAL 500 /* lines to parse between progress updates */
  29
  30
  31 static uint imported, totsize, totlines;
  32 static int lines_since_progress, do_progress;
  33 static struct timeval import_start;
  34 static time_t daemon_start, daemon_stop, incremental;
  35 static int daemon_is_running;
  36 static uint max_dt_depth;
  37
  38 static time_t next_dt_purge; /* when next to purge expired downtime */
  39 #define DT_PURGE_GRACETIME 300 /* seconds to add to next_dt_purge */
  40
  41 static time_t ltime; /* the timestamp from the current log-line */
  42
  43 static int dt_start, dt_stop;
  44 #define dt_depth (dt_start - dt_stop)
  45 static hash_table *host_downtime;
  46 static hash_table *service_downtime;
  47 static int downtime_id;
  48 static time_t probably_ignore_downtime;
  49
  50 struct downtime_entry {
  51         int id;
  52         int code;
  53         char *host;
  54         char *service;
  55         time_t start;
  56         time_t stop;
  57         int fixed;
  58         time_t duration;
  59         time_t started;
  60         time_t ended;
  61         int purged;
  62         int trigger;
  63         int slot;
  64         struct downtime_entry *next;
  65 };
  66
  67 #define NUM_DENTRIES 1024
  68 static struct downtime_entry **dentry;
  69 static time_t last_downtime_start;
  70
  71 static struct string_code event_codes[] = {
  72         add_ignored("Error"),
  73         add_ignored("Warning"),
  74         add_ignored("LOG ROTATION"),
  75         add_ignored("HOST NOTIFICATION"),
  76         add_ignored("HOST FLAPPING ALERT"),
  77         add_ignored("SERVICE NOTIFICATION"),
  78         add_ignored("SERVICE FLAPPING ALERT"),
  79         add_ignored("SERVICE EVENT HANDLER"),
  80         add_ignored("HOST EVENT HANDLER"),
  81         add_ignored("LOG VERSION"),
  82
  83         add_code(3, "PASSIVE HOST CHECK", NEBTYPE_HOSTCHECK_PROCESSED),
  84         add_code(4, "PASSIVE SERVICE CHECK", NEBTYPE_SERVICECHECK_PROCESSED),
  85         add_code(0, "EXTERNAL COMMAND", NEBTYPE_EXTERNALCOMMAND_END),
  86         add_code(5, "HOST ALERT", NEBTYPE_HOSTCHECK_PROCESSED),
  87         add_code(5, "INITIAL HOST STATE", NEBTYPE_HOSTCHECK_PROCESSED),
  88         add_code(5, "CURRENT HOST STATE", NEBTYPE_HOSTCHECK_PROCESSED),
  89         add_code(6, "SERVICE ALERT", NEBTYPE_SERVICECHECK_PROCESSED),
  90         add_code(6, "INITIAL SERVICE STATE", NEBTYPE_SERVICECHECK_PROCESSED),
  91         add_code(6, "CURRENT SERVICE STATE", NEBTYPE_SERVICECHECK_PROCESSED),
  92         add_code(3, "HOST DOWNTIME ALERT", NEBTYPE_DOWNTIME_LOAD + CONCERNS_HOST),
  93         add_code(4, "SERVICE DOWNTIME ALERT", NEBTYPE_DOWNTIME_LOAD + CONCERNS_SERVICE),
  94         { 0, NULL, 0, 0 },
  95 };
  96
  97 static struct string_code command_codes[] = {
  98         add_cdef(1, DEL_HOST_DOWNTIME),
  99         add_cdef(1, DEL_SVC_DOWNTIME),
 100         add_cdef(8, SCHEDULE_AND_PROPAGATE_HOST_DOWNTIME),
 101         add_cdef(8, SCHEDULE_AND_PROPAGATE_TRIGGERED_HOST_DOWNTIME),
 102         add_cdef(8, SCHEDULE_HOSTGROUP_HOST_DOWNTIME),
 103         add_cdef(8, SCHEDULE_HOSTGROUP_SVC_DOWNTIME),
 104         add_cdef(8, SCHEDULE_HOST_DOWNTIME),
 105         add_cdef(8, SCHEDULE_HOST_SVC_DOWNTIME),
 106         add_cdef(8, SCHEDULE_SERVICEGROUP_HOST_DOWNTIME),
 107         add_cdef(8, SCHEDULE_SERVICEGROUP_SVC_DOWNTIME),
 108         add_cdef(8, SCHEDULE_SVC_DOWNTIME),
 109
 110         /*
 111          * These really have one more field than listed here. We omit one
 112          * to make author and comment concatenated with a semi-colon by default.
 113          */
 114         add_cdef(6, ACKNOWLEDGE_SVC_PROBLEM),
 115         add_cdef(5, ACKNOWLEDGE_HOST_PROBLEM),
 116         { 0, NULL, 0, 0 },
 117 };
 118
 119
 120 static inline void print_strvec(char **v, int n)
 121 {
 122         int i;
 123
 124         for (i = 0; i < n; i++)
 125                 printf("v[%2d]: %s\n", i, v[i]);
 126 }
 127
 128
 129 static const char *tobytes(uint n)
 130 {
 131         const char *suffix = "KMGT";
 132         static char tbuf[2][30];
 133         static int t = 0;
 134         int shift = 1;
 135
 136         t ^= 1;
 137         if (n < 1024) {
 138                 sprintf(tbuf[t], "%d bytes", n);
 139                 return tbuf[t];
 140         }
 141
 142         while (n >> (shift * 10) > 1024)
 143                 shift++;
 144
 145         sprintf(tbuf[t], "%0.2f %ciB",
 146                         (float)n / (float)(1 << (shift * 10)), suffix[shift - 1]);
 147
 148         return tbuf[t];
 149 }
 150
 151 static void show_progress(void)
 152 {
 153         time_t eta, elapsed;
 154         float pct_done;
 155
 156         totlines += lines_since_progress;
 157         lines_since_progress = 0;
 158
 159         if (!do_progress)
 160                 return;
 161
 162         elapsed = time(NULL) - import_start.tv_sec;
 163         if (!elapsed)
 164                 elapsed = 1;
 165
 166         pct_done = ((float)imported / (float)totsize) * 100;
 167         eta = (elapsed / pct_done) * (100.0 - pct_done);
 168
 169         printf("\rImporting data: %.2f%% (%s) done ",
 170                    pct_done, tobytes(imported));
 171         if (elapsed > 10) {
 172                 printf("ETA: ");
 173                 if (eta > 60)
 174                         printf("%lum%lus", eta / 60, eta % 60);
 175                 else
 176                         printf("%lus", eta);
 177         }
 178         printf("        ");
 179 }
 180
 181 static void end_progress(void)
 182 {
 183         struct timeval tv;
 184         int mins;
 185         float secs;
 186
 187         gettimeofday(&tv, NULL);
 188
 189         /*
 190          * If any of the logfiles doesn't have a newline
 191          * at end of file, imported will be slightly off.
 192          * We set it hard here so as to make sure that
 193          * the final progress output stops at exactly 100%
 194          */
 195         imported = totsize;
 196
 197         show_progress();
 198         putchar('\n');
 199         secs = (tv.tv_sec - import_start.tv_sec) * 1000000;
 200         secs += tv.tv_usec - import_start.tv_usec;
 201         mins = (tv.tv_sec - import_start.tv_sec) / 60;
 202         secs /= 1000000;
 203         secs -= (mins * 60);
 204         printf("%s in %u lines imported in ", tobytes(totsize), totlines);
 205         if (mins)
 206                 printf("%dm ", mins);
 207         printf("%.3fs\n", secs);
 208 }
 209
 210 static int use_sql = 1;
 211 static int insert_downtime_event(int type, char *host, char *service, int id)
 212 {
 213         nebstruct_downtime_data ds;
 214         int result;
 215
 216         if (!is_interesting_service(host, service))
 217                 return 0;
 218
 219         dt_start += type == NEBTYPE_DOWNTIME_START;
 220         dt_stop += type == NEBTYPE_DOWNTIME_STOP;
 221         if (dt_depth > max_dt_depth)
 222                 max_dt_depth = dt_depth;
 223
 224         if (!use_sql)
 225                 return 0;
 226
 227         memset(&ds, 0, sizeof(ds));
 228
 229         ds.type = type;
 230         ds.timestamp.tv_sec = ltime;
 231         ds.host_name = host;
 232         ds.service_description = service;
 233         ds.downtime_id = id;
 234
 235         result = hook_downtime(NEBCALLBACK_DOWNTIME_DATA, (void *)&ds);
 236         if (result < 0)
 237                 crash("Failed to insert downtime:\n  type=%d, host=%s, service=%s, id=%d",
 238                           type, host, service, id);
 239
 240         return result;
 241 }
 242
 243 static int insert_service_check(struct string_code *sc)
 244 {
 245         nebstruct_service_check_data ds;
 246
 247         if (!is_interesting_service(strv[0], strv[1]))
 248                 return 0;
 249
 250         memset(&ds, 0, sizeof(ds));
 251
 252         ds.timestamp.tv_sec = ltime;
 253         ds.type = sc->code;
 254         ds.host_name = strv[0];
 255         ds.service_description = strv[1];
 256         if (sc->nvecs == 4) {
 257                 /* passive service check result */
 258                 if (*strv[2] >= '0' && *strv[2] <= '9')
 259                         ds.state = atoi(strv[2]);
 260                 else
 261                         ds.state = parse_service_state(strv[2]);
 262                 ds.state_type = HARD_STATE;
 263                 ds.current_attempt = 1;
 264                 ds.output = strv[3];
 265         } else {
 266                 ds.state = parse_service_state(strv[2]);
 267                 ds.state_type = soft_hard(strv[3]);
 268                 ds.current_attempt = atoi(strv[4]);
 269                 ds.output = strv[5];
 270         }
 271
 272         if (!use_sql)
 273                 return 0;
 274
 275         return hook_service_result(NEBCALLBACK_SERVICE_CHECK_DATA, (void *)&ds);
 276 }
 277
 278 static int insert_host_check(struct string_code *sc)
 279 {
 280         nebstruct_host_check_data ds;
 281
 282         if (!is_interesting_host(strv[0]))
 283                 return 0;
 284
 285         memset(&ds, 0, sizeof(ds));
 286
 287         ds.timestamp.tv_sec = ltime;
 288         ds.type = sc->code;
 289         ds.host_name = strv[0];
 290         if (sc->nvecs == 3) {
 291                 if (*strv[1] >= '0' && *strv[1] <= '9')
 292                         ds.state = atoi(strv[1]);
 293                 else
 294                         ds.state = parse_host_state(strv[1]);
 295                 /* passive host check result */
 296                 ds.output = strv[2];
 297                 ds.current_attempt = 1;
 298                 ds.state_type = HARD_STATE;
 299         } else {
 300                 ds.state = parse_host_state(strv[1]);
 301                 ds.state_type = soft_hard(strv[2]);
 302                 ds.current_attempt = atoi(strv[3]);
 303                 ds.output = strv[4];
 304         }
 305
 306         if (!use_sql)
 307                 return 0;
 308
 309         return hook_host_result(NEBCALLBACK_HOST_CHECK_DATA, (void *)&ds);
 310 }
 311
 312 static int insert_process_event(int type)
 313 {
 314         nebstruct_process_data ds;
 315
 316         if (!use_sql)
 317                 return 0;
 318
 319         memset(&ds, 0, sizeof(ds));
 320         ds.timestamp.tv_sec = ltime;
 321         ds.type = type;
 322         return hook_process_data(NEBCALLBACK_PROCESS_DATA, (void *)&ds);
 323 }
 324
 325 static int insert_acknowledgement(struct string_code *sc)
 326 {
 327         return 0;
 328 }
 329
 330 static void dt_print(char *tpc, time_t when, struct downtime_entry *dt)
 331 {
 332         if (!debug_level)
 333                 return;
 334
 335         printf("%s: time=%lu started=%lu start=%lu stop=%lu duration=%lu id=%d ",
 336                    tpc, when, dt->started, dt->start, dt->stop, dt->duration, dt->id);
 337         printf("%s", dt->host);
 338         if (dt->service)
 339                 printf(";%s", dt->service);
 340         putchar('\n');
 341 }
 342
 343 static struct downtime_entry *last_dte;
 344 static struct downtime_entry *del_dte;
 345
 346 static void remove_downtime(struct downtime_entry *dt);
 347 static int del_matching_dt(void *data)
 348 {
 349         struct downtime_entry *dt = data;
 350
 351         if (del_dte->id == dt->id) {
 352                 dt_print("ALSO", 0, dt);
 353                 remove_downtime(dt);
 354         }
 355
 356         return 0;
 357 }
 358
 359 static void stash_downtime_command(struct downtime_entry *dt)
 360 {
 361         dt->slot = dt->start % NUM_DENTRIES;
 362         dt->next = dentry[dt->slot];
 363         dentry[dt->slot] = dt;
 364 }
 365
 366 static void remove_downtime(struct downtime_entry *dt)
 367 {
 368         struct downtime_entry *old;
 369
 370         if (!is_interesting_service(dt->host, dt->service))
 371                 return;
 372
 373         insert_downtime_event(NEBTYPE_DOWNTIME_STOP, dt->host, dt->service, dt->id);
 374
 375         if (!dt->service)
 376                 old = hash_remove(host_downtime, dt->host);
 377         else
 378                 old = hash_remove2(service_downtime, dt->host, dt->service);
 379
 380         dt_print("RM_DT", ltime, dt);
 381         dt->purged = 1;
 382 }
 383
 384 static struct downtime_entry *
 385 dt_matches_command(struct downtime_entry *dt, char *host, char *service)
 386 {
 387         for (; dt; dt = dt->next) {
 388                 time_t diff;
 389
 390                 if (ltime > dt->stop || ltime < dt->start) {
 391                         continue;
 392                 }
 393
 394                 switch (dt->code) {
 395                 case SCHEDULE_SVC_DOWNTIME:
 396                         if (service && strcmp(service, dt->service))
 397                                 continue;
 398
 399                         /* fallthrough */
 400                 case SCHEDULE_HOST_DOWNTIME:
 401                 case SCHEDULE_HOST_SVC_DOWNTIME:
 402                         if (strcmp(host, dt->host)) {
 403                                 continue;
 404                         }
 405
 406                 case SCHEDULE_AND_PROPAGATE_HOST_DOWNTIME:
 407                 case SCHEDULE_AND_PROPAGATE_TRIGGERED_HOST_DOWNTIME:
 408                         /* these two have host set in dt, but
 409                          * it will not match all the possible hosts */
 410
 411                         /* fallthrough */
 412                 case SCHEDULE_HOSTGROUP_HOST_DOWNTIME:
 413                 case SCHEDULE_HOSTGROUP_SVC_DOWNTIME:
 414                 case SCHEDULE_SERVICEGROUP_HOST_DOWNTIME:
 415                 case SCHEDULE_SERVICEGROUP_SVC_DOWNTIME:
 416                         break;
 417                 default:
 418                         crash("dt->code not set properly\n");
 419                 }
 420
 421                 /*
 422                  * Once we get here all the various other criteria have
 423                  * been matched, so we need to check if the daemon was
 424                  * running when this downtime was supposed to have
 425                  * started, and otherwise use the daemon start time
 426                  * as the value to diff against
 427                  */
 428                 if (daemon_stop < dt->start && daemon_start > dt->start) {
 429                         debug("Adjusting dt->start (%lu) to (%lu)\n",
 430                                   dt->start, daemon_start);
 431                         dt->start = daemon_start;
 432                         if (dt->trigger && dt->duration)
 433                                 dt->stop = dt->start + dt->duration;
 434                 }
 435
 436                 diff = ltime - dt->start;
 437                 if (diff < 3 || dt->trigger || !dt->fixed)
 438                         return dt;
 439         }
 440
 441         return NULL;
 442 }
 443
 444 static struct downtime_entry *
 445 find_downtime_command(char *host, char *service)
 446 {
 447         int i;
 448         struct downtime_entry *shortcut = NULL;
 449
 450         if (last_dte && last_dte->start == ltime) {
 451                 shortcut = last_dte;
 452 //              return last_dte;
 453         }
 454         for (i = 0; i < NUM_DENTRIES; i++) {
 455                 struct downtime_entry *dt;
 456                 dt = dt_matches_command(dentry[i], host, service);
 457                 if (dt) {
 458                         if (shortcut && dt != shortcut)
 459                                 if (debug_level)
 460                                         printf("FIND shortcut no good\n");
 461                         last_dte = dt;
 462                         return dt;
 463                 }
 464         }
 465
 466         debug("FIND not\n");
 467         return NULL;
 468 }
 469
 470 static int print_downtime(void *data)
 471 {
 472         struct downtime_entry *dt = (struct downtime_entry *)data;
 473
 474         dt_print("UNCLOSED", ltime, dt);
 475
 476         return 0;
 477 }
 478
 479 static inline void set_next_dt_purge(time_t base, time_t add)
 480 {
 481         if (!next_dt_purge || next_dt_purge > base + add)
 482                 next_dt_purge = base + add;
 483
 484         if (next_dt_purge <= ltime)
 485                 next_dt_purge = ltime + 1;
 486 }
 487
 488 static inline void add_downtime(char *host, char *service, int id)
 489 {
 490         struct downtime_entry *dt, *cmd, *old;
 491
 492         if (!is_interesting_service(host, service))
 493                 return;
 494
 495         dt = malloc(sizeof(*dt));
 496         cmd = find_downtime_command(host, service);
 497         if (!cmd) {
 498                 warn("DT with no ext cmd? %lu %s;%s", ltime, host, service);
 499                 memset(dt, 0, sizeof(*dt));
 500                 dt->duration = 7200; /* the default downtime duration in nagios */
 501                 dt->start = ltime;
 502                 dt->stop = dt->start + dt->duration;
 503         }
 504         else
 505                 memcpy(dt, cmd, sizeof(*dt));
 506
 507         dt->host = strdup(host);
 508         dt->id = id;
 509         dt->started = ltime;
 510
 511         set_next_dt_purge(ltime, dt->duration);
 512
 513         if (!service) {
 514                 dt->service = NULL;
 515                 old = hash_update(host_downtime, dt->host, dt);
 516         }
 517         else {
 518                 dt->service = strdup(service);
 519                 old = hash_update2(service_downtime, dt->host, dt->service, dt);
 520         }
 521
 522         if (old && old != dt) {
 523                 free(old->host);
 524                 if (old->service)
 525                         free(old->service);
 526                 free(old);
 527         }
 528
 529         dt_print("IN_DT", ltime, dt);
 530         insert_downtime_event(NEBTYPE_DOWNTIME_START, dt->host, dt->service, dt->id);
 531 }
 532
 533 static time_t last_host_dt_del, last_svc_dt_del;
 534 static int register_downtime_command(struct string_code *sc)
 535 {
 536         struct downtime_entry *dt;
 537         char *start_time, *end_time, *duration = NULL;
 538         char *host = NULL, *service = NULL, *fixed, *triggered_by = NULL;
 539         time_t foo;
 540
 541         switch (sc->code) {
 542         case DEL_HOST_DOWNTIME:
 543                 last_host_dt_del = ltime;
 544                 return 0;
 545         case DEL_SVC_DOWNTIME:
 546                 last_svc_dt_del = ltime;
 547                 return 0;
 548
 549         case SCHEDULE_HOST_DOWNTIME:
 550                 if (strtotimet(strv[5], &foo))
 551                         duration = strv[4];
 552                 /* fallthrough */
 553         case SCHEDULE_AND_PROPAGATE_HOST_DOWNTIME:
 554         case SCHEDULE_AND_PROPAGATE_TRIGGERED_HOST_DOWNTIME:
 555         case SCHEDULE_HOST_SVC_DOWNTIME:
 556                 host = strv[0];
 557                 /* fallthrough */
 558         case SCHEDULE_HOSTGROUP_HOST_DOWNTIME:
 559         case SCHEDULE_HOSTGROUP_SVC_DOWNTIME:
 560         case SCHEDULE_SERVICEGROUP_HOST_DOWNTIME:
 561         case SCHEDULE_SERVICEGROUP_SVC_DOWNTIME:
 562                 start_time = strv[1];
 563                 end_time = strv[2];
 564                 fixed = strv[3];
 565                 if (strtotimet(strv[5], &foo))
 566                         triggered_by = strv[4];
 567                 if (!duration)
 568                         duration = strv[5];
 569
 570                 break;
 571
 572         case SCHEDULE_SVC_DOWNTIME:
 573                 host = strv[0];
 574                 service = strv[1];
 575                 start_time = strv[2];
 576                 end_time = strv[3];
 577                 fixed = strv[4];
 578                 if (strtotimet(strv[6], &foo)) {
 579                         triggered_by = strv[5];
 580                         duration = strv[6];
 581                 }
 582                 else {
 583                         duration = strv[5];
 584                 }
 585                 break;
 586
 587         default:
 588                 crash("Unknown downtime type: %d", sc->code);
 589         }
 590
 591         if (!(dt = calloc(sizeof(*dt), 1)))
 592                 crash("calloc(%u, 1) failed: %s", (uint)sizeof(*dt), strerror(errno));
 593
 594         dt->code = sc->code;
 595         if (host)
 596                 dt->host = strdup(host);
 597         if (service)
 598                 dt->service = strdup(service);
 599
 600         dt->trigger = triggered_by ? !!(*triggered_by - '0') : 0;
 601         if (strtotimet(start_time, &dt->start) || strtotimet(end_time, &dt->stop))
 602         {
 603                 print_strvec(strv, sc->nvecs);
 604                 crash("strtotime(): type: %s; start_time='%s'; end_time='%s'; duration='%s';",
 605                           command_codes[sc->code - 1].str, start_time, end_time, duration);
 606         }
 607
 608         /*
 609          * sometimes downtime commands can be logged according to
 610          * log version 1, while the log still claims to be version 2.
 611          * Apparently, this happens when using a daemon supporting
 612          * version 2 logging but a downtime command is added that
 613          * follows the version 1 standard.
 614          * As such, we simply ignore the result of the "duration"
 615          * field conversion and just accept that it might not work
 616          */
 617         (void)strtotimet(duration, &dt->duration);
 618         dt->fixed = *fixed - '0';
 619
 620         /*
 621          * ignore downtime scheduled to take place in the future.
 622          * It will be picked up by the module anyways
 623          */
 624         if (dt->start > time(NULL)) {
 625                 free(dt);
 626                 return 0;
 627         }
 628
 629         if (dt->duration > time(NULL)) {
 630                 warn("Bizarrely large duration (%lu)", dt->duration);
 631         }
 632         if (dt->start < ltime) {
 633                 if (dt->duration && dt->duration > ltime - dt->start)
 634                         dt->duration -= ltime - dt->start;
 635
 636                 dt->start = ltime;
 637         }
 638         if (dt->stop < ltime || dt->stop < dt->start)  {
 639                 /* retroactively scheduled downtime, or just plain wrong */
 640                 dt->stop = dt->start;
 641                 dt->duration = 0;
 642         }
 643
 644         if (dt->fixed && dt->duration != dt->stop - dt->start) {
 645 //              warn("duration doesn't match stop - start: (%lu : %lu)",
 646 //                       dt->duration, dt->stop - dt->start);
 647
 648                 dt->duration = dt->stop - dt->start;
 649         }
 650         else if (dt->duration > 86400 * 14) {
 651                 warn("Oddly long duration: %lu", dt->duration);
 652         }
 653
 654         debug("start=%lu; stop=%lu; duration=%lu; fixed=%d; trigger=%d; host=%s service=%s\n",
 655                   dt->start, dt->stop, dt->duration, dt->fixed, dt->trigger, dt->host, dt->service);
 656
 657         stash_downtime_command(dt);
 658         return 0;
 659 }
 660
 661 static int insert_downtime(struct string_code *sc)
 662 {
 663         int type;
 664         struct downtime_entry *dt = NULL;
 665         int id = 0;
 666         time_t dt_del_cmd;
 667         char *host, *service = NULL;
 668
 669         host = strv[0];
 670         if (sc->nvecs == 4) {
 671                 service = strv[1];
 672                 dt = hash_find2(service_downtime, host, service);
 673         }
 674         else
 675                 dt = hash_find(host_downtime, host);
 676
 677         /*
 678          * to stop a downtime we can either get STOPPED or
 679          * CANCELLED. So far, I've only ever seen STARTED
 680          * for when it actually starts though, and since
 681          * the Nagios daemon is reponsible for launching
 682          * it, it's unlikely there are more variants of
 683          * that string
 684          */
 685         type = NEBTYPE_DOWNTIME_STOP;
 686         if (!strcmp(strv[sc->nvecs - 2], "STARTED"))
 687                 type = NEBTYPE_DOWNTIME_START;
 688
 689         switch (type) {
 690         case NEBTYPE_DOWNTIME_START:
 691                 if (dt) {
 692                         if (!probably_ignore_downtime)
 693                                 dt_print("ALRDY", ltime, dt);
 694                         return 0;
 695                 }
 696
 697                 if (probably_ignore_downtime)
 698                         debug("Should probably ignore this downtime: %lu : %lu %s;%s\n",
 699                                   probably_ignore_downtime, ltime, host, service);
 700
 701                 if (ltime - last_downtime_start > 1)
 702                         downtime_id++;
 703
 704                 id = downtime_id;
 705                 add_downtime(host, service, id);
 706                 last_downtime_start = ltime;
 707                 break;
 708
 709         case NEBTYPE_DOWNTIME_STOP:
 710                 if (!dt) {
 711                         /*
 712                          * this can happen when overlapping downtime entries
 713                          * occur, and the start event for the second (or nth)
 714                          * downtime starts before the first downtime has had
 715                          * a stop event. It basically means we've almost
 716                          * certainly done something wrong.
 717                          */
 718                         //printf("no dt. ds.host_name == '%s'\n", ds.host_name);
 719                         //fprintf(stderr, "CRASHING: %s;%s\n", ds.host_name, ds.service_description);
 720                         //crash("DOWNTIME_STOP without matching DOWNTIME_START");
 721                         return 0;
 722                 }
 723
 724                 dt_del_cmd = !dt->service ? last_host_dt_del : last_svc_dt_del;
 725
 726                 if ((ltime - dt_del_cmd) > 1 && dt->duration - (ltime - dt->started) > 60) {
 727                         debug("Short dt duration (%lu) for %s;%s (dt->duration=%lu)\n",
 728                                    ltime - dt->started, dt->host, dt->service, dt->duration);
 729                 }
 730                 if (ltime - dt->started > dt->duration + DT_PURGE_GRACETIME)
 731                         dt_print("Long", ltime, dt);
 732
 733                 remove_downtime(dt);
 734                 /*
 735                  * Now delete whatever matching downtimes we can find.
 736                  * this must be here, or we'll recurse like crazy into
 737                  * remove_downtime(), possibly exhausting the stack
 738                  * frame buffer
 739                  */
 740                 del_dte = dt;
 741                 if (!dt->service)
 742                         hash_walk_data(host_downtime, del_matching_dt);
 743                 else
 744                         hash_walk_data(service_downtime, del_matching_dt);
 745                 break;
 746
 747         default:
 748                 return -1;
 749         }
 750
 751         return 0;
 752 }
 753
 754 static int dt_purged;
 755 static int purge_expired_dt(void *data)
 756 {
 757         struct downtime_entry *dt = data;
 758
 759         if (dt->purged) {
 760                 return 0;
 761         }
 762
 763         if (ltime + DT_PURGE_GRACETIME > dt->stop) {
 764                 dt_purged++;
 765                 debug("PURGE %lu: purging expired dt %d (start=%lu; started=%lu; stop=%lu; duration=%lu; host=%s; service=%s",
 766                           ltime, dt->id, dt->start, dt->started, dt->stop, dt->duration, dt->host, dt->service);
 767                 remove_downtime(dt);
 768         }
 769         else {
 770                 dt_print("PURGED_NOT_TIME", ltime, dt);
 771         }
 772
 773         set_next_dt_purge(dt->started, dt->duration);
 774
 775         return 0;
 776 }
 777
 778 static int purged_downtimes;
 779 static void purge_expired_downtime(void)
 780 {
 781         int tot_purged = 0;
 782
 783         next_dt_purge = 0;
 784         dt_purged = 0;
 785         hash_walk_data(host_downtime, purge_expired_dt);
 786         if (dt_purged)
 787                 debug("PURGE %d host downtimes purged", dt_purged);
 788         tot_purged += dt_purged;
 789         dt_purged = 0;
 790         hash_walk_data(service_downtime, purge_expired_dt);
 791         if (dt_purged)
 792                 debug("PURGE %d service downtimes purged", dt_purged);
 793         tot_purged += dt_purged;
 794         if (tot_purged)
 795                 debug("PURGE total %d entries purged", tot_purged);
 796
 797         if (next_dt_purge)
 798                 debug("PURGE next downtime purge supposed to run @ %lu, in %lu seconds",
 799                           next_dt_purge, next_dt_purge - ltime);
 800
 801         purged_downtimes += tot_purged;
 802 }
 803
 804 static inline void handle_start_event(void)
 805 {
 806         if (!daemon_is_running)
 807                 insert_process_event(NEBTYPE_PROCESS_START);
 808
 809         probably_ignore_downtime = daemon_start = ltime;
 810         daemon_is_running = 1;
 811 }
 812
 813 static inline void handle_stop_event(void)
 814 {
 815         if (daemon_is_running) {
 816                 insert_process_event(NEBTYPE_PROCESS_SHUTDOWN);
 817                 daemon_is_running = 0;
 818         }
 819         daemon_stop = ltime;
 820 }
 821
 822 static int parse_line(char *line, uint len)
 823 {
 824         char *ptr, *colon;
 825         int nvecs = 0;
 826         struct string_code *sc;
 827         static time_t last_ltime = 0;
 828
 829         imported += len + 1; /* make up for 1 lost byte per newline */
 830
 831         /* ignore empty lines */
 832         if (!len)
 833                 return 0;
 834
 835         if (++lines_since_progress >= PROGRESS_INTERVAL)
 836                 show_progress();
 837
 838         /* skip obviously bogus lines */
 839         if (len < 12 || *line != '[') {
 840                 warn("line %d; len too short, or line doesn't start with '[' (%s)", line_no, line);
 841                 return -1;
 842         }
 843
 844         ltime = strtoul(line + 1, &ptr, 10);
 845         if (line + 1 == ptr) {
 846                 crash("Failed to parse log timestamp from '%s'. I can't handle malformed logdata", line);
 847                 return -1;
 848         }
 849
 850         if (ltime < last_ltime) {
 851 //              warn("ltime < last_ltime (%lu < %lu) by %lu. Compensating...",
 852 //                       ltime, last_ltime, last_ltime - ltime);
 853                 ltime = last_ltime;
 854         }
 855         else
 856                 last_ltime = ltime;
 857
 858         /*
 859          * Incremental will be 0 if not set, or 1 if set but
 860          * the database is currently empty.
 861          * Note that this will not always do the correct thing,
 862          * as downtime entries that might have been scheduled for
 863          * purging may never show up as "stopped" in the database
 864          * with this scheme. As such, incremental imports absolutely
 865          * require that nothing is in scheduled downtime when the
 866          * import is running (well, started really, but it amounts
 867          * to the same thing).
 868          */
 869         if (ltime < incremental)
 870                 return 0;
 871
 872         if (next_dt_purge && ltime >= next_dt_purge)
 873                 purge_expired_downtime();
 874
 875         if (probably_ignore_downtime && ltime - probably_ignore_downtime > 1)
 876                 probably_ignore_downtime = 0;
 877
 878         while (*ptr == ']' || *ptr == ' ')
 879                 ptr++;
 880
 881         if (!is_interesting(ptr))
 882                 return 0;
 883
 884         if (!(colon = strchr(ptr, ':'))) {
 885                 /* stupid heuristic, but might be good for something,
 886                  * somewhere, sometime. if nothing else, it should suppress
 887                  * annoying output */
 888                 if (is_start_event(ptr)) {
 889                         handle_start_event();
 890                         return 0;
 891                 }
 892                 if (is_stop_event(ptr)) {
 893                         handle_stop_event();
 894                         return 0;
 895                 }
 896
 897                 /*
 898                  * An unhandled event. We should probably crash here
 899                  */
 900                 handle_unknown_event(line);
 901                 return -1;
 902         }
 903
 904         /* an event happened without us having gotten a start-event */
 905         if (!daemon_is_running) {
 906                 insert_process_event(NEBTYPE_PROCESS_START);
 907                 daemon_start = ltime;
 908                 daemon_is_running = 1;
 909         }
 910
 911         if (!(sc = get_event_type(ptr, colon - ptr))) {
 912                 handle_unknown_event(line);
 913                 return -1;
 914         }
 915
 916         if (sc->code == IGNORE_LINE)
 917                 return 0;
 918
 919         *colon = 0;
 920         ptr = colon + 1;
 921         while (*ptr == ' ')
 922                 ptr++;
 923
 924         if (sc->nvecs) {
 925                 int i;
 926
 927                 nvecs = vectorize_string(ptr, sc->nvecs);
 928
 929                 if (nvecs != sc->nvecs) {
 930                         /* broken line */
 931                         warn("Line %d in %s seems to not have all the fields it should",
 932                                  line_no, cur_file->path);
 933                         return -1;
 934                 }
 935
 936                 for (i = 0; i < sc->nvecs; i++) {
 937                         if (!strv[i]) {
 938                                 /* this should never happen */
 939                                 warn("Line %d in %s seems to be broken, or we failed to parse it into a vector",
 940                                          line_no, cur_file->path);
 941                                 return -1;
 942                         }
 943                 }
 944         }
 945
 946         switch (sc->code) {
 947                 char *semi_colon;
 948
 949         case NEBTYPE_EXTERNALCOMMAND_END:
 950                 semi_colon = strchr(ptr, ';');
 951                 if (!semi_colon)
 952                         return 0;
 953                 if (!(sc = get_command_type(ptr, semi_colon - ptr))) {
 954                         return 0;
 955                 }
 956                 if (sc->code == RESTART_PROGRAM) {
 957                         handle_stop_event();
 958                         return 0;
 959                 }
 960
 961                 nvecs = vectorize_string(semi_colon + 1, sc->nvecs);
 962                 if (nvecs != sc->nvecs) {
 963                         warn("nvecs discrepancy: %d vs %d (%s)\n", nvecs, sc->nvecs, ptr);
 964                 }
 965                 if (sc->code != ACKNOWLEDGE_HOST_PROBLEM &&
 966                         sc->code != ACKNOWLEDGE_SVC_PROBLEM)
 967                 {
 968                         register_downtime_command(sc);
 969                 } else {
 970                         insert_acknowledgement(sc);
 971                 }
 972                 break;
 973
 974         case NEBTYPE_HOSTCHECK_PROCESSED:
 975                 return insert_host_check(sc);
 976
 977         case NEBTYPE_SERVICECHECK_PROCESSED:
 978                 return insert_service_check(sc);
 979
 980         case NEBTYPE_DOWNTIME_LOAD + CONCERNS_HOST:
 981         case NEBTYPE_DOWNTIME_LOAD + CONCERNS_SERVICE:
 982                 return insert_downtime(sc);
 983
 984         case IGNORE_LINE:
 985                 return 0;
 986         }
 987
 988         return 0;
 989 }
 990
 991 static int parse_one_line(char *str, uint len)
 992 {
 993         if (parse_line(str, len) && use_sql && sql_errno())
 994                 crash("sql error: %s", sql_error());
 995
 996         return 0;
 997 }
 998
 999 static int hash_one_line(char *line, uint len)
1000 {
1001         return add_interesting_object(line);
1002 }
1003
1004 static int hash_interesting(const char *path)
1005 {
1006         struct stat st;
1007
1008         if (stat(path, &st) < 0)
1009                 crash("failed to stat %s: %s", path, strerror(errno));
1010
1011         lparse_path(path, st.st_size, hash_one_line);
1012
1013         return 0;
1014 }
1015
1016 extern const char *__progname;
1017 int main(int argc, char **argv)
1018 {
1019         int i, truncate_db = 0;
1020         struct naglog_file *nfile;
1021         char *db_name = "monitor_reports";
1022         char *db_user = "monitor";
1023         char *db_pass = "monitor";
1024         char *db_table = "report_data";
1025
1026         do_progress = isatty(fileno(stdout));
1027
1028         strv = calloc(sizeof(char *), MAX_NVECS);
1029         nfile = calloc(sizeof(*nfile), argc - 1);
1030         dentry = calloc(sizeof(*dentry), NUM_DENTRIES);
1031         if (!strv || !nfile || !dentry)
1032                 crash("Failed to alloc initial structs");
1033
1034
1035         for (num_nfile = 0,i = 1; i < argc; i++) {
1036                 char *opt, *arg = argv[i];
1037                 struct naglog_file *nf;
1038                 int eq_opt = 0;
1039
1040                 if ((opt = strchr(arg, '='))) {
1041                         *opt++ = '\0';
1042                         eq_opt = 1;
1043                 }
1044                 else if (i < argc - 1) {
1045                         opt = argv[i + 1];
1046                 }
1047
1048                 if (!prefixcmp(arg, "--incremental")) {
1049                         incremental = 1;
1050                         continue;
1051                 }
1052                 if (!prefixcmp(arg, "--no-sql")) {
1053                         use_sql = 0;
1054                         continue;
1055                 }
1056                 if (!prefixcmp(arg, "--no-progress")) {
1057                         do_progress = 0;
1058                         continue;
1059                 }
1060                 if (!prefixcmp(arg, "--debug") || !prefixcmp(arg, "-d")) {
1061                         do_progress = 0;
1062                         debug_level++;
1063                         continue;
1064                 }
1065                 if (!prefixcmp(arg, "--truncate-db")) {
1066                         truncate_db = 1;
1067                         continue;
1068                 }
1069                 if (!prefixcmp(arg, "--db-name")) {
1070                         if (!opt || !*opt)
1071                                 crash("%s requires a database name as an argument", arg);
1072                         db_name = opt;
1073                         if (opt && !eq_opt)
1074                                 i++;
1075                         continue;
1076                 }
1077                 if (!prefixcmp(arg, "--db-user")) {
1078                         if (!opt || !*opt)
1079                                 crash("%s requires a database username as argument", arg);
1080                         db_user = opt;
1081                         if (opt && !eq_opt)
1082                                 i++;
1083                         continue;
1084                 }
1085                 if (!prefixcmp(arg, "--db-pass")) {
1086                         if (!opt || !*opt)
1087                                 crash("%s requires a database username as argument", arg);
1088                         db_pass = opt;
1089                         if (opt && !eq_opt)
1090                                 i++;
1091                         continue;
1092                 }
1093                 if (!prefixcmp(arg, "--db-table")) {
1094                         if (!opt || !*opt)
1095                                 crash("%s requires a database table name as argument", arg);
1096                         db_table = opt;
1097                         if (opt && !eq_opt)
1098                                 i++;
1099                         continue;
1100                 }
1101                 if (!prefixcmp(arg, "--interesting") || !prefixcmp(arg, "-i")) {
1102                         if (!opt || !*opt)
1103                                 crash("%s requires a filename as argument", arg);
1104                         hash_interesting(opt);
1105                         if (opt && !eq_opt)
1106                                 i++;
1107                         continue;
1108                 }
1109
1110                 /* non-argument, so treat as file */
1111                 nf = &nfile[num_nfile++];
1112                 nf->path = arg;
1113                 first_log_time(nf);
1114                 totsize += nf->size;
1115         }
1116
1117         if (use_sql) {
1118                 sql_config("db_database", db_name);
1119                 sql_config("db_user", db_user);
1120                 sql_config("db_pass", db_pass);
1121                 sql_config("db_table", db_table);
1122
1123                 if (sql_init() < 0)
1124                         crash("sql_init() failed");
1125                 if (truncate_db)
1126                         sql_query("TRUNCATE %s", sql_table_name());
1127
1128                 if (incremental) {
1129                         MYSQL_RES *result;
1130                         MYSQL_ROW row;
1131                         sql_query("SELECT timestamp FROM %s.%s ORDER BY timestamp DESC LIMIT 1",
1132                                           db_name, db_table);
1133
1134                         if (!(result = sql_get_result()))
1135                                 crash("Failed to get last timestamp: %s\n", sql_error());
1136
1137                         /* someone might use --incremental with an empty
1138                          * database. We shouldn't crash in that case */
1139                         if ((row = sql_fetch_row(result)))
1140                                 incremental = strtoul(row[0], NULL, 0);
1141
1142                         sql_free_result(result);
1143                 }
1144                 /*
1145                  * We lock the table we'll be working with and disable
1146                  * indexes on it. Otherwise doing the actual inserts
1147                  * will take just about forever, as MySQL has to update
1148                  * and flush the index cache between each operation.
1149                  */
1150                 if (sql_query("ALTER TABLE %s DISABLE KEYS", sql_table_name()))
1151                         crash("Failed to disable keys: %s", sql_error());
1152                 if (sql_query("LOCK TABLES %s WRITE", sql_table_name()))
1153                         crash("Failed to lock table %s: %s", sql_table_name(), sql_error());
1154         }
1155
1156         log_grok_var("logfile", "/dev/null");
1157         log_grok_var("log_levels", "warn");
1158
1159         if (!num_nfile)
1160                 crash("Usage: %s [--incremental] [--interesting <file>] [--truncate-db] logfiles\n",
1161                           __progname);
1162
1163         if (log_init() < 0)
1164                 crash("log_init() failed");
1165
1166         qsort(nfile, num_nfile, sizeof(*nfile), nfile_cmp);
1167
1168         host_downtime = hash_init(HASH_TABLE_SIZE);
1169         service_downtime = hash_init(HASH_TABLE_SIZE);
1170
1171         if (hook_init() < 0)
1172                 crash("Failed to initialize hooks");
1173
1174         gettimeofday(&import_start, NULL);
1175         printf("Importing %s of data from %d files\n",
1176                    tobytes(totsize), num_nfile);
1177
1178         for (i = 0; i < num_nfile; i++) {
1179                 struct naglog_file *nf = &nfile[i];
1180                 cur_file = nf;
1181                 show_progress();
1182                 debug("importing from %s (%lu : %u)\n", nf->path, nf->first, nf->cmp);
1183                 line_no = 0;
1184                 lparse_path(nf->path, nf->size, parse_one_line);
1185                 imported++; /* make up for one lost byte per file */
1186         }
1187
1188         end_progress();
1189
1190         if (debug_level) {
1191                 if (dt_depth) {
1192                         printf("Unclosed host downtimes:\n");
1193                         puts("------------------------");
1194                         hash_walk_data(host_downtime, print_downtime);
1195                         printf("Unclosed service downtimes:\n");
1196                         puts("---------------------------");
1197                         hash_walk_data(service_downtime, print_downtime);
1198
1199                         printf("dt_depth: %d\n", dt_depth);
1200                 }
1201                 printf("purged downtimes: %d\n", purged_downtimes);
1202                 printf("max simultaneous host downtime hashes: %u\n",
1203                        hash_get_max_entries(host_downtime));
1204                 printf("max simultaneous service downtime hashes: %u\n",
1205                        hash_get_max_entries(service_downtime));
1206                 printf("max downtime depth: %u\n", max_dt_depth);
1207         }
1208
1209         if (use_sql) {
1210                 SQL_RESULT *res;
1211                 SQL_ROW row;
1212                 time_t start;
1213                 unsigned long entries;
1214
1215                 sql_query("SELECT id FROM %s ORDER BY id DESC LIMIT 1", sql_table_name());
1216                 if (!(res = sql_get_result()))
1217                         entries = 0;
1218                 else {
1219                         row = sql_fetch_row(res);
1220                         entries = strtoul(row[0], NULL, 0);
1221                         sql_free_result(res);
1222                 }
1223
1224                 signal(SIGINT, SIG_IGN);
1225                 sql_query("UNLOCK TABLES");
1226                 start = time(NULL);
1227                 printf("Creating sql table indexes. This will likely take ~%lu seconds\n",
1228                            (entries / 50000) + 1);
1229                 sql_query("ALTER TABLE %s ENABLE KEYS", sql_table_name());
1230                 printf("%lu database entries indexed in %lu seconds\n",
1231                            entries, time(NULL) - start);
1232                 sql_close();
1233         }
1234
1235         if (warnings && debug_level)
1236                 fprintf(stderr, "Total warnings: %d\n", warnings);
1237
1238         if (debug_level || dt_start != dt_stop)
1239                 fprintf(stderr, "Downtime data %s\n  started: %d\n  stopped: %d\n",
1240                         dt_depth ? "mismatch!" : "consistent", dt_start, dt_stop);
1241         if (hash_check_table(host_downtime))
1242                 fprintf(stderr, "Hash table inconsistencies for host_downtime\n");
1243         if (hash_check_table(service_downtime))
1244                 fprintf(stderr, "Hash table inconsistencies for service_downtime\n");
1245
1246         print_unhandled_events();
1247
1248         return 0;
1249 }