/* imbatchreport.c
 *
 * This is the input module for reading full text file data. A text file is a
 * non-binary file who's lines are delimited by the \n character. The file is
 * treated as a single message. An optional structured data can be written at
 * the end of the file.
 *
 * No state file are used as it should only grow with time. Instead the state
 * is managed using the name of the file. A "glob" allows the module to identify
 * "to be treated" files. The module can be configured either to deleted the
 * the file on success either to rename the file on success. The size limit is
 * fixed by rsyslog max message size global parameter. All files larger than this
 * limit produce a message which references it as "too large" and its new location
 * The "too large" files are also renamed to keep them available.
 *
 * This modules allows one to centralize batch reports with other standard logs and
 * performance monitoring in a single repository (ElasticSearch, HDFS, ...). This
 * centralization helps to identify cause of global performance issues.
 *
 * Work originally begun on 2014-07-01 by Philippe Duveau @ Pari Mutuel Urbain
 *
 * This file is contribution of rsyslog.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *       -or-
 *       see COPYING.ASL20 in the source distribution
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "config.h"
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h> /* do NOT remove: will soon be done by the module generation macros */
#include <sys/types.h>
#include <unistd.h>
#include <glob.h>
#include <fnmatch.h>
#ifdef HAVE_SYS_STAT_H
    #include <sys/stat.h>
#endif
#include "rsyslog.h" /* error codes etc... */
#include "dirty.h"
#include "cfsysline.h" /* access to config file objects */
#include "module-template.h"
#include "srUtils.h" /* some utility functions */
#include "msg.h"
#include "errmsg.h"
#include "glbl.h"
#include "datetime.h"
#include "unicode-helper.h"
#include "prop.h"
#include "stringbuf.h"
#include "ruleset.h"
#include "ratelimit.h"

#include <regex.h>

MODULE_TYPE_INPUT /* must be present for input modules, do not remove */
    MODULE_TYPE_NOKEEP;
MODULE_CNFNAME("imbatchreport")

/* defines for freebsd */
#ifndef O_LARGEFILE
    #define O_LARGEFILE 0
#endif

/* Module static data */
DEF_IMOD_STATIC_DATA /* must be present, starts static data */
    DEFobjCurrIf(glbl) DEFobjCurrIf(ruleset) DEFobjCurrIf(datetime) DEFobjCurrIf(prop)

#define SRUCTDATA_BUFFER_LEN 150
#define READ_BUFFER_LEN 512
#define FILE_TOO_LARGE "File too large : "
#define FILE_TOO_LARGE_LEN sizeof(FILE_TOO_LARGE) - 1

#define DFLT_PollInterval 10

#define ADD_METADATA_UNSPECIFIED -1

        typedef enum action_batchreport_t {
            action_nothing,
            action_rename,
            action_delete
        } action_batchreport_t;

struct instanceConf_s {
    uchar *pszFollow_glob;
    uchar *pszDirName;
    uchar *pszFileBaseName;
    uchar *pszTag;
    int lenTag;
    uchar *pszTSk;
    int lenTSk;
    uchar *pszProgk;
    int lenProgk;
    int must_stop;
    uchar *pszBindRuleset;
    int bDedupSpace;
    int iFacility;
    int iSeverity;
    char *ff_regex;
    /* Full treatment : this should contain a regex applied on filename. The matching
    part is then replaced with ff_replace to put the file out of scan criteria */
    regex_t ff_preg;

    char *ff_rename;
    int len_rename;

    char *ff_reject;
    int len_reject;

    int filename_oversize;
    ruleset_t *pBindRuleset;
    /* ruleset to bind listener to (use system default if unspecified) */

    ratelimit_t *ratelimiter;

    struct instanceConf_s *next;

    action_batchreport_t action;

    char *pszNewFName;
    int fd;

    sbool goon;
};

/* global configuration variables */
static struct {
    uchar *hostname;
    size_t lhostname;

    char *msg_buffer;
    size_t max_msg_size;

    instanceConf_t *root;

    /* number of seconds to sleep when there was no file activity */
    int iPollInterval;
} fixedModConf;

/* config variables */
struct modConfData_s {
    rsconf_t *pConf; /* our overall config object */
};

static prop_t *pInputName = NULL;
/* there is only one global inputName for all messages generated by this input */

/* module-global parameters */
static struct cnfparamdescr modpdescr[] = {
    {"pollinginterval", eCmdHdlrPositiveInt, 0},
};
static struct cnfparamblk modpblk = {CNFPARAMBLK_VERSION, sizeof(modpdescr) / sizeof(struct cnfparamdescr), modpdescr};

/* input instance parameters */
static struct cnfparamdescr inppdescr[] = {
    {"reports", eCmdHdlrString, CNFPARAM_REQUIRED},
    {"tag", eCmdHdlrString, CNFPARAM_REQUIRED},
    {"programkey", eCmdHdlrString, 0},
    {"timestampkey", eCmdHdlrString, 0},
    {"deduplicatespace", eCmdHdlrBinary, 0},
    {"rename", eCmdHdlrString, 0},
    {"delete", eCmdHdlrString, 0},
    {"severity", eCmdHdlrSeverity, 0},
    {"facility", eCmdHdlrFacility, 0},
    {"ruleset", eCmdHdlrString, 0},
};
static struct cnfparamblk inppblk = {CNFPARAMBLK_VERSION, sizeof(inppdescr) / sizeof(struct cnfparamdescr), inppdescr};

#include "im-helper.h" /* must be included AFTER the type definitions! */

/* enqueue the read file line as a message. The provided string is
 * not freed - thuis must be done by the caller.
 */
static rsRetVal enqMsg(instanceConf_t *pInst, smsg_t *pMsg) {
    DEFiRet;

    MsgSetFlowControlType(pMsg, eFLOWCTL_FULL_DELAY);
    MsgSetInputName(pMsg, pInputName);
    MsgSetHOSTNAME(pMsg, fixedModConf.hostname, (const int)fixedModConf.lhostname);
    MsgSetTAG(pMsg, pInst->pszTag, pInst->lenTag);
    MsgSetPROCID(pMsg, "-");
    MsgSetMSGID(pMsg, "-");

    pMsg->iFacility = pInst->iFacility >> 3;
    pMsg->iSeverity = pInst->iSeverity;

    MsgSetRuleset(pMsg, pInst->pBindRuleset);

    CHKiRet(ratelimitAddMsg(pInst->ratelimiter, NULL, pMsg));

finalize_it:
    RETiRet;
}

/* The following is a cancel cleanup handler for strmReadLine(). It is necessary in case
 * strmReadLine() is cancelled while processing the stream. -- rgerhards, 2008-03-27
 */
static void pollFileCancelCleanup(void *pArg) {
    instanceConf_t *ppInst = (instanceConf_t *)pArg;
    if (ppInst->fd > 0) close(ppInst->fd);
    if (ppInst->pszNewFName) free(ppInst->pszNewFName);
}

/* readAndSendFile try to read the file and send the message.
 * @param pInst point to instance
 * @param filename the file name
 * @param fstate the file stat
 */
static rsRetVal readAndSendFile(instanceConf_t *pInst, char *filename, char *fpath, struct stat *fstat) {
    smsg_t *pMsg = NULL;
    size_t file_len, read_len = 0, sd_buf_l, msg_len = 0, idx = 0;
    int last_is_space = 0;
    struct timeval tvm;
    uchar sd_buffer[SRUCTDATA_BUFFER_LEN];
    uchar read_buffer[READ_BUFFER_LEN];

    DEFiRet;

    CHKiRet(msgConstruct(&pMsg));

    msgAddMetadata(pMsg, (uchar *)"filename", (uchar *)filename);

    /* get the file modification time : end of the batch*/
    tvm.tv_sec = fstat->st_mtime;
    tvm.tv_usec = 0;

    file_len = lseek(pInst->fd, 0, SEEK_END);

    MsgSetStructuredData(pMsg, "-");

    /* Let's read the end of the file first and put it in the buffer for structuredData
     * This will help to find the real end of the message
     */
    sd_buf_l = (file_len < SRUCTDATA_BUFFER_LEN) ? file_len : SRUCTDATA_BUFFER_LEN;

    if (lseek(pInst->fd, file_len - sd_buf_l, SEEK_SET) >= 0) {
        uchar *sdp = sd_buffer + sd_buf_l - 1;
        int nb_rm = 0; /* number of space chars removed */
        size_t stdata_len = 0, t;
        char *tmp;

        if ((t = read(pInst->fd, sd_buffer, sd_buf_l)) != sd_buf_l) {
            LogError(0, RS_RET_READ_ERR, "read end of file for structured data failed (%zu / %zu)", t, sd_buf_l);
            return RS_RET_READ_ERR;
        }

        /* let's trim the end */
        for (; sdp > sd_buffer && (*sdp == '\n' || *sdp == '\t' || *sdp == ' '); sdp--, sd_buf_l--) file_len--;

        if (sd_buf_l > 1 && *sdp == ']') {
            stdata_len = 1;
            /* it seems that we have structured data let find the begin */
            for (; sdp > sd_buffer && *sdp != '['; sdp--, stdata_len++) {
                if (*sdp == '\n') {
                    /* line feed not supported in structured data */
                    stdata_len--;
                    memmove(sdp, sdp + 1, stdata_len);
                    nb_rm++;
                }
            }
            if (*sdp == '[') {
                /* we got a structured data */
                DBGPRINTF("structured data : %.*s\n", (int)stdata_len, sdp);
                MsgAddToStructuredData(pMsg, sdp, stdata_len);

                /* extracting timestamp from structured data overwrite the file creation time */
                if (pInst->pszTSk) {
                    uchar *field = (uchar *)strstr((char *)sdp, (char *)pInst->pszTSk), v;
                    if (field != NULL) {
                        tvm.tv_sec = 0;
                        tvm.tv_usec = 0;
                        for (field += pInst->lenTSk; (v = *field ^ 0x30) <= 9; field++)
                            tvm.tv_sec = tvm.tv_sec * 10 + v;
                    }
                }

                /* extracting program from structured data */
                if (pInst->pszProgk) {
                    char *field = strstr((char *)sdp, (char *)pInst->pszProgk);
                    if (field != NULL) {
                        tmp = field + pInst->lenProgk;
                        if ((field = strchr(tmp, '\"')) != NULL) {
                            *field = '\0';
                            MsgSetAPPNAME(pMsg, tmp);
                        }
                    }
                }

                /* let's trim until useful message end */
                for (sdp--; sdp > sd_buffer && (*sdp == '\n' || *sdp == '\t' || *sdp == ' '); sdp--) nb_rm++;
            }
        }
        /* computing the new file_len */
        file_len -= nb_rm + stdata_len;
    }

    datetime.timeval2syslogTime(&tvm, &pMsg->tTIMESTAMP, TIME_IN_UTC);
    pMsg->ttGenTime = tvm.tv_sec;

    /* go back to beginning */
    if (lseek(pInst->fd, 0, SEEK_SET) < 0) {
        LogError(0, RS_RET_READ_ERR, "readAndSendFile : error while seeking to beginning.");
        return RS_RET_READ_ERR;
    }

    /* Now read the file */
    msg_len = 0;
    while (msg_len < fixedModConf.max_msg_size &&
           (read_len = read(pInst->fd, read_buffer, (file_len > READ_BUFFER_LEN) ? READ_BUFFER_LEN : file_len)) > 0) {
        file_len -= read_len;
        idx = 0;
        while (read_len > 0 && msg_len < fixedModConf.max_msg_size) {
            switch (read_buffer[idx]) {
                case '\t':
                case ' ':
                    /* this is to reduce consecutive spaces to only one */
                    if (!last_is_space) fixedModConf.msg_buffer[msg_len++] = ' ';
                    /* if pInst->bDedupSpace is off last_is_space will never be true */
                    last_is_space = pInst->bDedupSpace;
                    break;
                case '\n':
                    /* this is for trailing spaces */
                    if (last_is_space) msg_len--;
                    fixedModConf.msg_buffer[msg_len++] = '\\';
                    /* risk of overflow is managed by making buffer one char longer
                     * than fixedModConf.max_msg_size */
                    fixedModConf.msg_buffer[msg_len++] = 'n';
                    break;
                default:
                    fixedModConf.msg_buffer[msg_len++] = read_buffer[idx];
                    last_is_space = 0;
            }
            idx++;
            read_len--;
        }
    }

    close(pInst->fd);
    pInst->fd = 0;

    if (file_len > 0 || read_len > 0) {
        /* file is too large to be stored in one message */
        memcpy(fixedModConf.msg_buffer, FILE_TOO_LARGE, FILE_TOO_LARGE_LEN);
        msg_len = strlen(fpath);
        memcpy(fixedModConf.msg_buffer + FILE_TOO_LARGE_LEN, fpath, msg_len);
        msg_len += FILE_TOO_LARGE_LEN;
    }

    /* file is stored in the message */
    MsgSetRawMsg(pMsg, fixedModConf.msg_buffer, msg_len);

    MsgSetMSGoffs(pMsg, 0);
    if ((iRet = enqMsg(pInst, pMsg)) == RS_RET_OK && (file_len > 0 || read_len > 0)) iRet = RS_RET_FILE_TOO_LARGE;

finalize_it:
    RETiRet;
}

/* poll a glob */
static void pollFile(instanceConf_t *pInst) {
    pInst->fd = 0;
    glob_t glob_res;

    pthread_cleanup_push(pollFileCancelCleanup, pInst);

    DBGPRINTF("polling files : %s\n", pInst->pszFollow_glob);

    /* We "glob" to find candidate regular file (or other) */
    if (glob((char *)pInst->pszFollow_glob, GLOB_NOSORT, 0, &glob_res) != 0) FINALIZE;

    for (size_t i = 0; i < glob_res.gl_pathc && glbl.GetGlobalInputTermState() == 0; i++) {
        struct stat fstat;
        rsRetVal ret;
        char *filename = strrchr(glob_res.gl_pathv[i], '/');
        if (filename)
            filename++;
        else
            filename = glob_res.gl_pathv[i];
        char *fpath = glob_res.gl_pathv[i];

        /*  let's verify that the file is a regular one */
        if (!stat(fpath, &fstat) && S_ISREG(fstat.st_mode)) {
            regmatch_t matches[1];
            int toolargeOrFailure = 0;

            DBGPRINTF("Regular file found '%s')\n", fpath);

            /* With this test we verify that we have conditions to remove the
             * file from glob scope. If the regular expression not apply we
             * can not rename it */
            if (regexec(&pInst->ff_preg, fpath, 1, matches, 0)) {
                pInst->must_stop = 1;
                FINALIZE;
            }

            pInst->fd = open(fpath, O_NOCTTY | O_RDONLY | O_NONBLOCK | O_LARGEFILE, 0);

            if (pInst->fd <= 0) {
                /* file could be open unfortunately we will try each polling */
                char errStr[512];
                int eno = errno;
                rs_strerror_r(eno, errStr, sizeof(errStr));
                LogError(0, RS_RET_READ_ERR, "open the file %s failed with error %s", fpath, errStr);
                continue;
            }

            /* let's read the file and send it to output */
            ret = readAndSendFile(pInst, filename, fpath, &fstat);
            /* is the file to large to be sent */
            toolargeOrFailure = ret == RS_RET_FILE_TOO_LARGE;

            if (ret != RS_RET_OK && ret != RS_RET_FILE_TOO_LARGE) {
                LogError(0, ret, "The module could not manage the file %s", fpath);
                toolargeOrFailure = 1;
            }

            if (pInst->action == action_rename || toolargeOrFailure) {
                pInst->pszNewFName = (char *)malloc(strlen(fpath) + pInst->filename_oversize);
                memcpy(pInst->pszNewFName, fpath, matches[0].rm_so);
                strcpy((char *)pInst->pszNewFName + matches[0].rm_so,
                       (toolargeOrFailure) ? pInst->ff_reject : pInst->ff_rename);

                if (rename(fpath, pInst->pszNewFName)) {
                    /* if the module can not rename the file, it must stop to avoid flooding
                     * but it keep chance to manage max files as possible
                     */
                    LogError(0, RS_RET_STREAM_DISABLED,
                             "module stopped : was unable"
                             " to rename form %s to %s.",
                             fpath, pInst->pszNewFName);
                    pInst->must_stop = 1;
                } else
                    DBGPRINTF("file %s sent and renamed to %s.\n", fpath, pInst->pszNewFName);
                free(pInst->pszNewFName);
                pInst->pszNewFName = NULL;
            } else {
                if (unlink(fpath)) {
                    /* if the module can not remove the file, it must stop to avoid flooding
                     * but it keep chance to manage max files as possible
                     */
                    LogError(0, RS_RET_STREAM_DISABLED, "module stopped : unable to delete %s.", fpath);
                    pInst->must_stop = 1;
                } else
                    DBGPRINTF("file %s sent and deleted\n", fpath);
            }
        } /* if stat */
    } /* for */

finalize_it:
    globfree(&glob_res);

    pthread_cleanup_pop(0);
}

static void addInstance(instanceConf_t *inst) {
    if (fixedModConf.root == NULL) {
        fixedModConf.root = inst;
    } else {
        fixedModConf.root->next = inst;
        fixedModConf.root = inst;
    }
}

/* create input instance, set default parameters, and
 * add it to the list of instances.
 */
static rsRetVal createInstance(instanceConf_t **pinst) {
    instanceConf_t *inst;
    DEFiRet;

    *pinst = NULL;

    CHKmalloc(inst = (instanceConf_t *)malloc(sizeof(instanceConf_t)));

    inst->next = NULL;
    inst->pBindRuleset = NULL;

    inst->pszBindRuleset = NULL;
    inst->pszFollow_glob = NULL;
    inst->pszDirName = NULL;
    inst->pszFileBaseName = NULL;
    inst->pszTag = NULL;
    inst->pszTSk = NULL;
    inst->pszProgk = NULL;
    inst->ff_regex = NULL;
    inst->ff_rename = NULL;
    inst->ff_reject = NULL;

    inst->iSeverity = LOG_NOTICE;
    inst->iFacility = LOG_LOCAL0;
    inst->len_rename = 0;
    inst->len_reject = 0;
    inst->bDedupSpace = 1;
    inst->goon = 0;
    inst->ratelimiter = NULL;

    inst->action = action_nothing;

    inst->must_stop = 0;

    *pinst = inst;
finalize_it:
    RETiRet;
}

/* the basen(ame) buffer must be of size MAXFNAME
 * returns the index of the slash in front of basename
 */
static int getBasename(uchar *const __restrict__ basen, uchar *const __restrict__ path) {
    int i;
    const int lenName = ustrlen(path);
    for (i = lenName; i >= 0; --i) {
        if (path[i] == '/') {
            if (i == lenName)
                basen[0] = '\0';
            else {
                memcpy(basen, path + i + 1, lenName - i);
            }
            break;
        }
    }
    if (i == -1) {
        memcpy(basen, path, lenName);
        i = 0;
    }
    return i;
}

/* this function checks instance parameters and does some required pre-processing
 * (e.g. split filename in path and actual name)
 * Note: we do NOT use dirname()/basename() as they have portability problems.
 */
static rsRetVal checkInstance(instanceConf_t *inst) {
    char dirn[MAXFNAME];
    uchar basen[MAXFNAME];
    int i;
    struct stat sb;
    int r;
    int eno;
    char errStr[512], *s, *d;
    regmatch_t matches[1];
    DEFiRet;

    i = getBasename(basen, inst->pszFollow_glob);
    memcpy(dirn, inst->pszFollow_glob, i);
    dirn[i] = '\0';
    CHKmalloc(inst->pszFileBaseName = (uchar *)strdup((char *)basen));
    CHKmalloc(inst->pszDirName = (uchar *)strdup(dirn));

    if (dirn[0] == '\0') {
        dirn[0] = '.';
        dirn[1] = '\0';
    }
    r = stat(dirn, &sb);
    if (r != 0) {
        eno = errno;
        rs_strerror_r(eno, errStr, sizeof(errStr));
        LogError(0, RS_RET_CONFIG_ERROR, "Configured directory can not be stated '%s': %s", dirn, errStr);
        ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
    }
    if (!S_ISDIR(sb.st_mode)) {
        LogError(0, RS_RET_CONFIG_ERROR, "Configured directory is NOT a directory : '%s'", dirn);
        ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
    }

    if (stat((char *)inst->pszFollow_glob, &sb) == 0 && !S_ISREG(sb.st_mode)) {
        LogError(0, RS_RET_CONFIG_ERROR, "Configured report is not a glob or a regular file.");
        ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
    }

    for (s = (char *)inst->pszFollow_glob, d = dirn; *s; s++, d++) *d = (*s != '*' && *s != '?') ? *s : '~';
    *d = '\0';

    if (regexec(&inst->ff_preg, dirn, 1, matches, 0)) {
        LogError(0, RS_RET_CONFIG_ERROR, "Regex does not match globed filenames: Instance ignored to avoid loops.");
        ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
    }
    if (inst->action == action_rename) {
        strcpy(dirn + matches[0].rm_so, inst->ff_rename);
        if (fnmatch((char *)inst->pszFollow_glob, dirn, FNM_PATHNAME) == 0) {
            LogError(0, RS_RET_INVALID_PARAMS,
                     "Normal renaming leaves files in glob scope: Instance ignored to avoid loops.");
            ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
        }
    }
    strcpy(dirn + matches[0].rm_so, inst->ff_reject);
    if (fnmatch((char *)inst->pszFollow_glob, dirn, FNM_PATHNAME) == 0) {
        LogError(0, RS_RET_INVALID_PARAMS,
                 "Reject renaming leaves files in glob scope: Instance ignored to avoid loops.");
        ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
    }
    dbgprintf("instance checked");

finalize_it:
    RETiRet;
}

static void freeInstance(instanceConf_t *inst) {
    if (inst == NULL) return;

    if (inst->pszBindRuleset) free(inst->pszBindRuleset);
    if (inst->pszFollow_glob) free(inst->pszFollow_glob);
    if (inst->pszDirName) free(inst->pszDirName);
    if (inst->pszFileBaseName) free(inst->pszFileBaseName);
    if (inst->pszTag) free(inst->pszTag);
    if (inst->pszTSk) free(inst->pszTSk);
    if (inst->pszProgk) free(inst->pszProgk);

    if (inst->len_reject) regfree(&inst->ff_preg);

    if (inst->ff_regex) free(inst->ff_regex);
    if (inst->ff_rename) free(inst->ff_rename);
    if (inst->ff_reject) free(inst->ff_reject);

    if (inst->ratelimiter) ratelimitDestruct(inst->ratelimiter);
    free(inst);
}

BEGINnewInpInst
    struct cnfparamvals *pvals;
    instanceConf_t *inst = NULL;
    int i;
    char *temp;
    CODESTARTnewInpInst;
    DBGPRINTF("newInpInst (imbatchreport)\n");

    pvals = nvlstGetParams(lst, &inppblk, NULL);
    if (pvals == NULL) {
        ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS);
    }

    DBGPRINTF("input param blk in imbatchreport:\n");
    if (Debug) cnfparamsPrint(&inppblk, pvals);

    CHKiRet(createInstance(&inst));

    for (i = 0; i < inppblk.nParams; ++i) {
        if (!pvals[i].bUsed) continue;
        if (!strcmp(inppblk.descr[i].name, "reports")) {
            inst->pszFollow_glob = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
        } else if (!strcmp(inppblk.descr[i].name, "tag")) {
            inst->pszTag = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
            inst->lenTag = ustrlen(inst->pszTag);
        } else if (!strcmp(inppblk.descr[i].name, "programkey")) {
            inst->pszProgk = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
            inst->lenProgk = ustrlen(inst->pszProgk) + 2;
        } else if (!strcmp(inppblk.descr[i].name, "timestampkey")) {
            inst->pszTSk = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
            inst->lenTSk = ustrlen(inst->pszTSk) + 1;
        } else if (!strcmp(inppblk.descr[i].name, "deduplicatespace")) {
            inst->bDedupSpace = pvals[i].val.d.n;
        } else if (!strcmp(inppblk.descr[i].name, "ruleset")) {
            inst->pszBindRuleset = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
        } else if (!strcmp(inppblk.descr[i].name, "severity")) {
            inst->iSeverity = pvals[i].val.d.n;
        } else if (!strcmp(inppblk.descr[i].name, "facility")) {
            inst->iFacility = pvals[i].val.d.n;
        } else if (!strcmp(inppblk.descr[i].name, "rename")) {
            if (inst->action == action_delete) {
                LogError(0, RS_RET_PARAM_ERROR, "'rename' and 'delete' are exclusive !");
                ABORT_FINALIZE(RS_RET_PARAM_ERROR);
            }

            inst->ff_regex = es_str2cstr(pvals[i].val.d.estr, NULL);

            while ((temp = strchr(inst->ff_regex, '\t')) != NULL) *temp = ' ';

            inst->len_reject = 0;

            if ((inst->ff_rename = strchr(inst->ff_regex, ' ')) != NULL) {
                *inst->ff_rename++ = '\0';

                while (*inst->ff_rename == ' ') inst->ff_rename++;
                if ((inst->ff_reject = strchr(inst->ff_rename, ' ')) != NULL) {
                    *inst->ff_reject++ = '\0';
                    while (*inst->ff_reject == ' ') inst->ff_reject++;

                    temp = strchr(inst->ff_reject, ' ');
                    if (temp) *temp = '\0';

                    if (strcmp(inst->ff_rename, "-")) {
                        inst->ff_rename = strdup(inst->ff_rename);
                        inst->len_rename = strlen(inst->ff_rename);
                    } else {
                        inst->ff_rename = strdup("");
                        inst->len_rename = 0;
                    }

                    inst->ff_reject = strdup(inst->ff_reject);
                    inst->len_reject = strlen(inst->ff_reject);

                    if (inst->len_reject && regcomp(&inst->ff_preg, (char *)inst->ff_regex, REG_EXTENDED)) {
                        inst->len_reject = 0;
                        LogError(0, RS_RET_SYNTAX_ERROR,
                                 "The first part of 'rename' "
                                 "parameter does not contain a valid regex");
                        ABORT_FINALIZE(RS_RET_SYNTAX_ERROR);
                    }
                }
            }
            if (inst->len_reject == 0) {
                LogError(0, RS_RET_PARAM_ERROR,
                         "'rename' must specify THREE "
                         "parameters separated by spaces or tabs ! The second "
                         "parameter can be a null string to get this use a '-'.");
                ABORT_FINALIZE(RS_RET_PARAM_ERROR);
            }

            inst->action = action_rename;

        } else if (!strcmp(inppblk.descr[i].name, "delete")) {
            if (inst->action == action_rename) {
                LogError(0, RS_RET_PARAM_ERROR, "'rename' and 'delete' are exclusive !");
                ABORT_FINALIZE(RS_RET_PARAM_ERROR);
            }

            inst->ff_regex = es_str2cstr(pvals[i].val.d.estr, NULL);

            while ((temp = strchr(inst->ff_regex, '\t')) != NULL) *temp = ' ';

            inst->len_reject = 0;

            if ((inst->ff_reject = strchr(inst->ff_regex, ' ')) != NULL) {
                *inst->ff_reject++ = '\0';

                while (*inst->ff_reject == ' ') inst->ff_reject++;

                temp = strchr(inst->ff_reject, ' ');
                if (temp) *temp = '\0';

                inst->ff_reject = strdup(inst->ff_reject);
                inst->len_reject = strlen(inst->ff_reject);

                if (regcomp(&inst->ff_preg, (char *)inst->ff_regex, REG_EXTENDED)) {
                    inst->len_reject = 0;
                    LogError(0, RS_RET_SYNTAX_ERROR,
                             "The first part of 'delete' parameter does not contain a valid regex");
                    ABORT_FINALIZE(RS_RET_SYNTAX_ERROR);
                }
            }

            if (inst->len_reject == 0) {
                LogError(0, RS_RET_PARAM_ERROR, "'delete' must specify TWO parameters separated by spaces or tabs !");
                ABORT_FINALIZE(RS_RET_PARAM_ERROR);
            }
            inst->action = action_delete;

        } else {
            dbgprintf("Configuration param '%s' non-handled\n", inppblk.descr[i].name);
        }
    }

    if (inst->action == action_nothing) {
        LogError(0, RS_RET_PARAM_NOT_PERMITTED, "either 'rename' or 'delete' must be set");
        ABORT_FINALIZE(RS_RET_PARAM_NOT_PERMITTED);
    }

    inst->filename_oversize = (inst->len_rename > inst->len_reject) ? inst->len_rename : inst->len_reject;

    CHKiRet(ratelimitNew(&inst->ratelimiter, "imbatchreport", (char *)inst->pszFollow_glob));

    inst->goon = 1;

    CHKiRet(checkInstance(inst));

finalize_it:
    CODE_STD_FINALIZERnewInpInst

        if (iRet == RS_RET_OK) addInstance(inst);
    else freeInstance(inst);

    cnfparamvalsDestruct(pvals, &inppblk);
ENDnewInpInst

BEGINbeginCnfLoad
    CODESTARTbeginCnfLoad;
    pModConf->pConf = pConf;
    fixedModConf.iPollInterval = DFLT_PollInterval;

    fixedModConf.msg_buffer = NULL;
    fixedModConf.root = NULL;
ENDbeginCnfLoad


BEGINsetModCnf
    struct cnfparamvals *pvals = NULL;
    int i;
    CODESTARTsetModCnf;
    pvals = nvlstGetParams(lst, &modpblk, NULL);
    if (pvals == NULL) {
        LogError(0, RS_RET_MISSING_CNFPARAMS, "error processing module config parameters [module(...)]");
        ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS);
    }

    if (Debug) {
        dbgprintf("module (global) param blk for imbatchreport:\n");
        cnfparamsPrint(&modpblk, pvals);
    }

    for (i = 0; i < modpblk.nParams; ++i) {
        if (!pvals[i].bUsed) continue;
        if (!strcmp(modpblk.descr[i].name, "pollinginterval")) {
            fixedModConf.iPollInterval = (int)pvals[i].val.d.n;
        } else {
            dbgprintf(
                "program error, non-handled "
                "param '%s' in beginCnfLoad\n",
                modpblk.descr[i].name);
        }
    }
finalize_it:
    if (pvals != NULL) cnfparamvalsDestruct(pvals, &modpblk);
ENDsetModCnf


BEGINendCnfLoad
    CODESTARTendCnfLoad;
    dbgprintf("polling interval is %d\n", fixedModConf.iPollInterval);
ENDendCnfLoad


BEGINcheckCnf
    instanceConf_t *inst;
    CODESTARTcheckCnf;
    for (inst = fixedModConf.root; inst != NULL; inst = inst->next) {
        std_checkRuleset(pModConf, inst);
    }
    if (fixedModConf.root == NULL) {
        LogError(0, RS_RET_NO_LISTNERS, "no files configured to be monitored - no input will be gathered");
        iRet = RS_RET_NO_LISTNERS;
    }
ENDcheckCnf

BEGINactivateCnf
    CODESTARTactivateCnf;
ENDactivateCnf

BEGINfreeCnf
    instanceConf_t *inst, *del;
    CODESTARTfreeCnf;
    for (inst = fixedModConf.root; inst != NULL;) {
        del = inst;
        inst = inst->next;
        freeInstance(del);
    }
ENDfreeCnf

BEGINwillRun
    CODESTARTwillRun;
    CHKiRet(prop.Construct(&pInputName));
    CHKiRet(prop.SetString(pInputName, UCHAR_CONSTANT("imbatchreport"), sizeof("imbatchreport") - 1));
    CHKiRet(prop.ConstructFinalize(pInputName));

    fixedModConf.max_msg_size = glbl.GetMaxLine(runConf);
    DBGPRINTF("Max message len %zu\n", fixedModConf.max_msg_size);
    CHKmalloc(fixedModConf.msg_buffer = (char *)malloc(fixedModConf.max_msg_size + 1));
finalize_it:
ENDwillRun

BEGINrunInput
    CODESTARTrunInput;
    fixedModConf.hostname = glbl.GetLocalHostName();
    fixedModConf.lhostname = ustrlen(fixedModConf.hostname);

    while (glbl.GetGlobalInputTermState() == 0) {
        instanceConf_t *pInst;
        for (pInst = fixedModConf.root; pInst != NULL; pInst = pInst->next) {
            if (pInst->goon) {
                if (glbl.GetGlobalInputTermState() == 1) break;
                pollFile(pInst);
                /* We got a major problem so */
                pInst->goon = !pInst->must_stop;
            }
        }

        if (glbl.GetGlobalInputTermState() == 0) srSleep(fixedModConf.iPollInterval, 10);
    }
    DBGPRINTF("terminating upon request of rsyslog core\n");
    RETiRet;
ENDrunInput

/* This function is called by the framework after runInput() has been terminated. It
 * shall free any resources and prepare the module for unload.
 */
BEGINafterRun
    CODESTARTafterRun;
    if (fixedModConf.msg_buffer) free(fixedModConf.msg_buffer);
    if (pInputName != NULL) prop.Destruct(&pInputName);
ENDafterRun


BEGINisCompatibleWithFeature
    CODESTARTisCompatibleWithFeature;
    if (eFeat == sFEATURENonCancelInputTermination) iRet = RS_RET_OK;
ENDisCompatibleWithFeature


/* The following entry points are defined in module-template.h.
 * In general, they need to be present, but you do NOT need to provide
 * any code here.
 */
BEGINmodExit
    CODESTARTmodExit;

    objRelease(datetime, CORE_COMPONENT);
    objRelease(glbl, CORE_COMPONENT);
    objRelease(prop, CORE_COMPONENT);
    objRelease(ruleset, CORE_COMPONENT);

ENDmodExit


BEGINqueryEtryPt
    CODESTARTqueryEtryPt;
    CODEqueryEtryPt_STD_IMOD_QUERIES;
    CODEqueryEtryPt_STD_CONF2_QUERIES;
    CODEqueryEtryPt_STD_CONF2_setModCnf_QUERIES;
    CODEqueryEtryPt_STD_CONF2_IMOD_QUERIES;
    CODEqueryEtryPt_IsCompatibleWithFeature_IF_OMOD_QUERIES;
ENDqueryEtryPt


/* modInit() is called once the module is loaded. It must perform all module-wide
 * initialization tasks. There are also a number of housekeeping tasks that the
 * framework requires. These are handled by the macros. Please note that the
 * complexity of processing is depending on the actual module. However, only
 * thing absolutely necessary should be done here. Actual app-level processing
 * is to be performed in runInput(). A good sample of what to do here may be to
 * set some variable defaults.
 */
BEGINmodInit()
    CODESTARTmodInit;
    *ipIFVersProvided = CURR_MOD_IF_VERSION;
    CODEmodInit_QueryRegCFSLineHdlr CHKiRet(objUse(glbl, CORE_COMPONENT));
    CHKiRet(objUse(datetime, CORE_COMPONENT));
    CHKiRet(objUse(ruleset, CORE_COMPONENT));
    CHKiRet(objUse(prop, CORE_COMPONENT));
ENDmodInit


static inline void std_checkRuleset_genErrMsg(__attribute__((unused)) modConfData_t *modConf, instanceConf_t *inst) {
    LogError(0, NO_ERRCODE,
             "ruleset '%s' for %s not found - "
             "using default ruleset instead",
             inst->pszBindRuleset, inst->pszFollow_glob);
}
