Пример #1
0
/** function syslog_messages()
 *  This is the main page display function in Syslog.  Displays all the
 *  syslog messages that are relevant to Syslog.
*/
function syslog_messages($tab = "syslog")
{
    global $colors, $sql_where, $hostfilter, $severities;
    global $config, $syslog_incoming_config, $reset_multi, $syslog_levels;
    include "./include/global_arrays.php";
    /* force the initial timespan to be 30 minutes for performance reasons */
    if (!isset($_SESSION["sess_syslog_init"])) {
        $_SESSION["sess_current_timespan"] = 1;
        $_SESSION["sess_syslog_init"] = 1;
    }
    if (file_exists("./lib/timespan_settings.php")) {
        include "./lib/timespan_settings.php";
    } else {
        include "./include/html/inc_timespan_settings.php";
    }
    include dirname(__FILE__) . "/config.php";
    /* create the custom css and javascript for the page */
    generate_syslog_cssjs();
    $url_curr_page = get_browser_query_string();
    $sql_where = "";
    if ($_REQUEST["rows"] == -1) {
        $row_limit = read_config_option("num_rows_syslog");
    } elseif ($_REQUEST["rows"] == -2) {
        $row_limit = 999999;
    } else {
        $row_limit = $_REQUEST["rows"];
    }
    $syslog_messages = get_syslog_messages($sql_where, $row_limit, $tab);
    $total_rows = syslog_filter($sql_where, $tab);
    /* generate page list */
    $url_page_select = get_page_list($_REQUEST["page"], MAX_DISPLAY_PAGES, $row_limit, $total_rows, "syslog.php?tab={$tab}");
    if ($total_rows > 0) {
        $nav = "<tr bgcolor='#" . $colors["header"] . "'>\n\t\t\t\t\t<td colspan='13'>\n\t\t\t\t\t\t<table width='100%' cellspacing='0' cellpadding='0' border='0'>\n\t\t\t\t\t\t\t<tr>\n\t\t\t\t\t\t\t\t<td align='left' class='textHeaderDark'>\n\t\t\t\t\t\t\t\t\t<strong>&lt;&lt; ";
        if ($_REQUEST["page"] > 1) {
            $nav .= "<a class='linkOverDark' href='syslog.php?tab={$tab}&page=" . ($_REQUEST["page"] - 1) . "'>";
        }
        $nav .= "Previous";
        if ($_REQUEST["page"] > 1) {
            $nav .= "</a>";
        }
        $nav .= "</strong>\n\t\t\t\t\t\t\t\t</td>\n\n\t\t\t\t\t\t\t\t<td align='center' class='textHeaderDark'>\n\t\t\t\t\t\t\t\t\tShowing Rows " . ($total_rows == 0 ? "None" : $row_limit * ($_REQUEST["page"] - 1) + 1 . " to " . ($total_rows < $row_limit || $total_rows < $row_limit * $_REQUEST["page"] ? $total_rows : $row_limit * $_REQUEST["page"]) . " of {$total_rows} [{$url_page_select}]") . "\n\t\t\t\t\t\t\t\t</td>\n\n\t\t\t\t\t\t\t\t<td align='right' class='textHeaderDark'>\n\t\t\t\t\t\t\t\t\t<strong>";
        if ($_REQUEST["page"] * $row_limit < $total_rows) {
            $nav .= "<a class='linkOverDark' href='syslog.php?tab={$tab}&page=" . ($_REQUEST["page"] + 1) . "'>";
        }
        $nav .= "Next";
        if ($_REQUEST["page"] * $row_limit < $total_rows) {
            $nav .= "</a>";
        }
        $nav .= " &gt;&gt;</strong>\n\t\t\t\t\t\t\t\t</td>\n\n\t\t\t\t\t\t\t</tr>\n\t\t\t\t\t\t</table>\n\t\t\t\t\t</td>\n\t\t\t\t</tr>\n";
    } else {
        $nav = "<tr bgcolor='#" . $colors["header"] . "' class='noprint'>\n\t\t\t\t\t<td colspan='22'>\n\t\t\t\t\t\t<table width='100%' cellspacing='0' cellpadding='0' border='0'>\n\t\t\t\t\t\t\t<tr>\n\t\t\t\t\t\t\t\t<td align='center' class='textHeaderDark'>\n\t\t\t\t\t\t\t\t\tNo Rows Found\n\t\t\t\t\t\t\t\t</td>\n\n\t\t\t\t\t\t\t</tr>\n\t\t\t\t\t\t</table>\n\t\t\t\t\t</td>\n\t\t\t\t</tr>\n";
    }
    print $nav;
    if ($tab == "syslog") {
        if (api_plugin_user_realm_auth('syslog_alerts.php')) {
            $display_text = array("nosortt" => array("Actions", "ASC"), "host_id" => array("Host", "ASC"), "logtime" => array("Date", "ASC"), "message" => array("Message", "ASC"), "facility_id" => array("Facility", "ASC"), "priority_id" => array("Priority", "ASC"));
        } else {
            $display_text = array("host_id" => array("Host", "ASC"), "logtime" => array("Date", "ASC"), "message" => array("Message", "ASC"), "facility_id" => array("Facility", "ASC"), "priority_id" => array("Priority", "ASC"));
        }
        html_header_sort($display_text, $_REQUEST["sort_column"], $_REQUEST["sort_direction"]);
        $hosts = array_rekey(syslog_db_fetch_assoc("SELECT host_id, host FROM `" . $syslogdb_default . "`.`syslog_hosts`"), "host_id", "host");
        $facilities = array_rekey(syslog_db_fetch_assoc("SELECT facility_id, facility FROM `" . $syslogdb_default . "`.`syslog_facilities`"), "facility_id", "facility");
        $priorities = array_rekey(syslog_db_fetch_assoc("SELECT priority_id, priority FROM `" . $syslogdb_default . "`.`syslog_priorities`"), "priority_id", "priority");
        $i = 0;
        if (sizeof($syslog_messages) > 0) {
            foreach ($syslog_messages as $syslog_message) {
                $title = "'" . str_replace("\"", "", str_replace("'", "", $syslog_message["message"])) . "'";
                $tip_options = "CLICKCLOSE, 'true', WIDTH, '40', DELAY, '500', FOLLOWMOUSE, 'true', FADEIN, 450, FADEOUT, 450, BGCOLOR, '#F9FDAF', STICKY, 'true', SHADOWCOLOR, '#797C6E', TITLE, 'Message'";
                syslog_row_color($colors["alternate"], $colors["light"], $i, $priorities[$syslog_message["priority_id"]], $title);
                $i++;
                if (api_plugin_user_realm_auth('syslog_alerts.php')) {
                    print "<td style='whitspace-nowrap;width:1%;'>";
                    if ($syslog_message['mtype'] == 'main') {
                        print "<a href='syslog_alerts.php?id=" . $syslog_message[$syslog_incoming_config["id"]] . "&date=" . $syslog_message["logtime"] . "&action=newedit&type=0'><img src='images/green.gif' align='absmiddle' border=0></a>\n\t\t\t\t\t\t<a href='syslog_removal.php?id=" . $syslog_message[$syslog_incoming_config["id"]] . "&date=" . $syslog_message["logtime"] . "&action=newedit&type=new&type=0'><img src='images/red.gif' align='absmiddle' border=0></a>\n";
                    }
                    print "</td>\n";
                }
                print "<td>" . $hosts[$syslog_message["host_id"]] . "</td>\n";
                print "<td>" . $syslog_message["logtime"] . "</td>\n";
                print "<td>" . (strlen($_REQUEST["filter"]) ? eregi_replace("(" . preg_quote($_REQUEST["filter"]) . ")", "<span style='background-color: #F8D93D;'>\\1</span>", title_trim($syslog_message[$syslog_incoming_config["textField"]], get_request_var_request("trimval"))) : title_trim($syslog_message[$syslog_incoming_config["textField"]], get_request_var_request("trimval"))) . "</td>\n";
                print "<td>" . ucfirst($facilities[$syslog_message["facility_id"]]) . "</td>\n";
                print "<td>" . ucfirst($priorities[$syslog_message["priority_id"]]) . "</td>\n";
            }
        } else {
            print "<tr><td><em>No Messages</em></td></tr>";
        }
        print $nav;
        html_end_box(false);
        syslog_syslog_legend();
    } else {
        $display_text = array("name" => array("Alert Name", "ASC"), "severity" => array("Severity", "ASC"), "count" => array("Count", "ASC"), "logtime" => array("Date", "ASC"), "logmsg" => array("Message", "ASC"), "slhost" => array("Host", "ASC"), "facility" => array("Facility", "ASC"), "priority" => array("Priority", "ASC"));
        html_header_sort($display_text, $_REQUEST["sort_column"], $_REQUEST["sort_direction"]);
        $i = 0;
        if (sizeof($syslog_messages) > 0) {
            foreach ($syslog_messages as $log) {
                $title = "'" . str_replace("\"", "", str_replace("'", "", $log["logmsg"])) . "'";
                $tip_options = "CLICKCLOSE, 'true', WIDTH, '40', DELAY, '500', FOLLOWMOUSE, 'true', FADEIN, 450, FADEOUT, 450, BGCOLOR, '#F9FDAF', STICKY, 'true', SHADOWCOLOR, '#797C6E', TITLE, 'Message'";
                switch ($log['severity']) {
                    case "0":
                        $color = "notice";
                        break;
                    case "1":
                        $color = "warn";
                        break;
                    case "2":
                        $color = "crit";
                        break;
                    default:
                        $color = "info";
                        break;
                }
                syslog_row_color($colors["alternate"], $colors["light"], $i, $color, $title);
                $i++;
                print "<td><a class='linkEditMain' href='" . $config["url_path"] . "plugins/syslog/syslog.php?id=" . $log["seq"] . "&tab=current'>" . (strlen($log["name"]) ? $log["name"] : "Alert Removed") . "</a></td>\n";
                print "<td>" . (isset($severities[$log["severity"]]) ? $severities[$log["severity"]] : "Unknown") . "</td>\n";
                print "<td>" . $log["count"] . "</td>\n";
                print "<td>" . $log["logtime"] . "</td>\n";
                print "<td>" . (strlen($_REQUEST["filter"]) ? eregi_replace("(" . preg_quote($_REQUEST["filter"]) . ")", "<span style='background-color: #F8D93D;'>\\1</span>", title_trim($log["logmsg"], get_request_var_request("trimval"))) : title_trim($log["logmsg"], get_request_var_request("trimval"))) . "</td>\n";
                print "<td>" . $log["host"] . "</td>\n";
                print "<td>" . ucfirst($log["facility"]) . "</td>\n";
                print "<td>" . ucfirst($log["priority"]) . "</td>\n";
            }
        } else {
            print "<tr><td><em>No Messages</em></td></tr>";
        }
        print $nav;
        html_end_box(false);
        syslog_log_legend();
    }
    /* put the nav bar on the bottom as well */
    ?>

								</td>
							</tr>
						</table>
					</td>
				</tr>
			</table>
			</form>
			<script type='text/javascript'>
			function syslogFindPos(obj) {
				var curleft = curtop = 0;

				if (obj.offsetParent) {
					curleft = obj.offsetLeft;
					curtop  = obj.offsetTop;

					while (obj = obj.offsetParent) {
						curleft += obj.offsetLeft;
						curtop  += obj.offsetTop;
					}
				}

				return [curleft,curtop];
			}

			function setHostMultiSelect() {
				selectPos = syslogFindPos(document.getElementById("host_select"));
				textSize  = document.getElementById("host_all").scrollHeight;
				if (textSize == 0) textSize = 16;

				if (window.innerHeight) {
					height = window.innerHeight;
				}else{
					height = document.body.clientHeight;
				}
				//alert("Height:"+height+", YPos:"+selectPos[1]+", TextSize:"+textSize);

				/* the full window size of the multi-select */
				size = parseInt((height-selectPos[1]-5)/textSize);
				window.onresize = null;
				document.getElementById("host_select").size=size;
				window.onresize = this;
			}

			window.onresize = setHostMultiSelect;
			window.onload   = setHostMultiSelect;
			</script>
<?php 
}
Пример #2
0
function syslog_get_alert_records(&$sql_where, $row_limit)
{
    include dirname(__FILE__) . "/config.php";
    if (get_request_var_request("filter") != "") {
        $sql_where .= (strlen($sql_where) ? " AND " : "WHERE ") . "(message LIKE '%%" . get_request_var_request("filter") . "%%' OR " . "email LIKE '%%" . get_request_var_request("filter") . "%%' OR " . "notes LIKE '%%" . get_request_var_request("filter") . "%%' OR " . "name LIKE '%%" . get_request_var_request("filter") . "%%')";
    }
    if (get_request_var_request("enabled") == "-1") {
        // Display all status'
    } elseif (get_request_var_request("enabled") == "1") {
        $sql_where .= (strlen($sql_where) ? " AND " : "WHERE ") . "enabled='on'";
    } else {
        $sql_where .= (strlen($sql_where) ? " AND " : "WHERE ") . "enabled=''";
    }
    $query_string = "SELECT *\n\t\tFROM `" . $syslogdb_default . "`.`syslog_alert`\n\t\t{$sql_where}\n\t\tORDER BY " . get_request_var_request("sort_column") . " " . get_request_var_request("sort_direction") . " LIMIT " . $row_limit * (get_request_var_request("page") - 1) . "," . $row_limit;
    return syslog_db_fetch_assoc($query_string);
}
Пример #3
0
				WHERE ' . $syslog_incoming_config['textField'] . "\n\t\t\t\tLIKE '%" . $syslog_report['message'] . "%'";
            }
            if ($syslog_report['type'] == 'messagee') {
                $sql = 'SELECT * FROM `' . $syslogdb_default . '`.`syslog`
				WHERE ' . $syslog_incoming_config['textField'] . "\n\t\t\t\tLIKE '%" . $syslog_report['message'] . "'";
            }
            if ($syslog_report['type'] == 'host') {
                $sql = 'SELECT * FROM `' . $syslogdb_default . '`.`syslog`
				WHERE ' . $syslog_incoming_config['hostField'] . "='" . $syslog_report['message'] . "'";
            }
            if ($sql != '') {
                $date2 = date('Y-m-d H:i:s', time());
                $date1 = date('Y-m-d H:i:s', time() - 86400);
                $sql .= " AND logtime BETWEEN '" . $date1 . "' AND '" . $date2 . "'";
                $sql .= ' ORDER BY logtime DESC';
                $items = syslog_db_fetch_assoc($sql);
                syslog_debug('We have ' . db_affected_rows($syslog_cnn) . ' items for the Report');
                if (sizeof($items)) {
                    foreach ($items as $item) {
                        $reptext .= '<tr>' . $item['date'] . '</td><td>' . $item['time'] . '</td><td>' . $item['message'] . "</td></tr>\n";
                    }
                }
                if ($reptext != '') {
                    $headtext .= "<html><head><style type='text/css'>";
                    $headtext .= file_get_contents($config['base_path'] . '/plugins/syslog/syslog.css');
                    $headtext .= '</style></head>';
                    $headtext .= "<body class='body'><h1 class='h1'>" . $syslog_report['name'] . "</h1><table>\n" . "<tr><th class='th'>Date</th><th class='th'>Time</th><th class='th'>Message</th></tr>\n" . $reptext;
                    $headtext .= "</table>\n";
                    $smsalert = $headtext;
                    // Send mail
                    syslog_sendemail($syslog_report['email'], '', 'Event Report - ' . $syslog_report['name'], $headtext, $smsalert);
Пример #4
0
function syslog_get_removal_records(&$sql_where, $row_limit)
{
    include dirname(__FILE__) . '/config.php';
    if (get_request_var('filter') != '') {
        $sql_where .= (strlen($sql_where) ? ' AND ' : 'WHERE ') . "(message LIKE '%" . get_request_var('filter') . "%' OR " . "notes LIKE '%" . get_request_var('filter') . "%' OR " . "name LIKE '%" . get_request_var('filter') . "%')";
    }
    if (get_request_var('enabled') == '-1') {
        // Display all status'
    } elseif (get_request_var('enabled') == '1') {
        $sql_where .= (strlen($sql_where) ? ' AND ' : 'WHERE ') . "enabled='on'";
    } else {
        $sql_where .= (strlen($sql_where) ? ' AND ' : 'WHERE ') . "enabled=''";
    }
    $query_string = "SELECT *\n\t\tFROM `" . $syslogdb_default . "`.`syslog_remove`\n\t\t{$sql_where}\n\t\tORDER BY " . get_request_var('sort_column') . ' ' . get_request_var('sort_direction') . ' LIMIT ' . $row_limit * (get_request_var('page') - 1) . ',' . $row_limit;
    return syslog_db_fetch_assoc($query_string);
}
Пример #5
0
function syslog_upgrade_pre_oneoh_tables($options = false, $isbackground = false)
{
    global $config, $cnn_id, $syslog_levels, $database_default, $syslog_upgrade;
    include dirname(__FILE__) . "/config.php";
    $syslog_levels = array(1 => 'emerg', 2 => 'crit', 3 => 'alert', 4 => 'err', 5 => 'warn', 6 => 'notice', 7 => 'info', 8 => 'debug', 9 => 'other');
    if ($isbackground) {
        $table = 'syslog_pre_upgrade';
    } else {
        $table = 'syslog';
    }
    /* validate some simple information */
    $mysqlVersion = syslog_get_mysql_version("syslog");
    $truncate = isset($options["upgrade_type"]) && $options["upgrade_type"] == "truncate" ? true : false;
    $upgrade_type = isset($options["upgrade_type"]) ? $options["upgrade_type"] : "inline";
    $engine = isset($options["engine"]) && $options["engine"] == "innodb" ? "InnoDB" : "MyISAM";
    $partitioned = isset($options["db_type"]) && $options["db_type"] == "part" ? true : false;
    $syslogexists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `" . $syslogdb_default . "` LIKE '{$table}'"));
    /* disable collection for a bit */
    set_config_option('syslog_enabled', '');
    if ($upgrade_type == "truncate") {
        return;
    }
    if ($upgrade_type == "inline" || $isbackground) {
        syslog_setup_table_new($options);
        api_plugin_register_realm('syslog', 'syslog.php', 'Plugin -> Syslog User', 1);
        api_plugin_register_realm('syslog', 'syslog_alerts.php,syslog_removal.php,syslog_reports.php', 'Plugin -> Syslog Administration', 1);
        /* get the realm id's and change from old to new */
        $user = db_fetch_cell("SELECT id FROM plugin_realms WHERE file='syslog.php'") + 100;
        $admin = db_fetch_cell("SELECT id FROM plugin_realms WHERE file='syslog_alerts.php'") + 100;
        if ($user > 100) {
            $users = db_fetch_assoc("SELECT user_id FROM user_auth_realm WHERE realm_id=37");
            if (sizeof($users)) {
                foreach ($users as $u) {
                    db_execute("INSERT INTO user_auth_realm\n\t\t\t\t\t(realm_id, user_id) VALUES ({$user}, " . $u["user_id"] . ")\n\t\t\t\t\tON DUPLICATE KEY UPDATE realm_id=VALUES(realm_id)");
                    db_execute("DELETE FROM user_auth_realm\n\t\t\t\t\tWHERE user_id=" . $u["user_id"] . "\n\t\t\t\t\tAND realm_id=37");
                }
            }
        }
        if ($admin > 100) {
            $admins = db_fetch_assoc("SELECT user_id FROM user_auth_realm WHERE realm_id=38");
            if (sizeof($admins)) {
                foreach ($admins as $user) {
                    db_execute("INSERT INTO user_auth_realm\n\t\t\t\t\t(realm_id, user_id) VALUES ({$admin}, " . $user["user_id"] . ")\n\t\t\t\t\tON DUPLICATE KEY UPDATE realm_id=VALUES(realm_id)");
                    db_execute("DELETE FROM user_auth_realm\n\t\t\t\t\tWHERE user_id=" . $user["user_id"] . "\n\t\t\t\t\tAND realm_id=38");
                }
            }
        }
        /* get the database table names */
        $rows = syslog_db_fetch_assoc("SHOW TABLES FROM `" . $syslogdb_default . "`");
        if (sizeof($rows)) {
            foreach ($rows as $row) {
                $tables[] = $row["Tables_in_" . $syslogdb_default];
            }
        }
        /* create the reports table */
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_logs` (\n\t\t\talert_id integer unsigned not null default '0',\n\t\t\tlogseq bigint unsigned NOT NULL,\n\t\t\tlogtime TIMESTAMP NOT NULL default '0000-00-00 00:00:00',\n\t\t\tlogmsg " . ($mysqlVersion > 5 ? "varchar(1024)" : "text") . " default NULL,\n\t\t\thost varchar(32) default NULL,\n\t\t\tfacility varchar(10) default NULL,\n\t\t\tpriority varchar(10) default NULL,\n\t\t\tcount integer unsigned NOT NULL default '0',\n\t\t\thtml blob default NULL,\n\t\t\tseq bigint unsigned NOT NULL auto_increment,\n\t\t\tPRIMARY KEY (seq),\n\t\t\tKEY logseq (logseq),\n\t\t\tKEY alert_id (alert_id),\n\t\t\tKEY host (host),\n\t\t\tKEY seq (seq),\n\t\t\tKEY logtime (logtime),\n\t\t\tKEY priority (priority),\n\t\t\tKEY facility (facility)) ENGINE={$engine};");
        /* create the soft removal table */
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_host_facilities` (\n\t\t\t`host_id` int(10) unsigned NOT NULL,\n\t\t\t`facility_id` int(10) unsigned NOT NULL,\n\t\t\t`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,\n\t\t\tPRIMARY KEY  (`host_id`,`facility_id`)) ENGINE={$engine};");
        /* create the host reference table */
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_hosts` (\n\t\t\t`host_id` int(10) unsigned NOT NULL auto_increment,\n\t\t\t`host` VARCHAR(128) NOT NULL,\n\t\t\t`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,\n\t\t\tPRIMARY KEY (`host`),\n\t\t\tKEY host_id (`host_id`),\n\t\t\tKEY last_updated (`last_updated`)) ENGINE={$engine}\n\t\t\tCOMMENT='Contains all hosts currently in the syslog table'");
        /* check upgrade of syslog_alert */
        $sql = "DESCRIBE `" . $syslogdb_default . "`.`syslog_alert`";
        $columns = array();
        $array = syslog_db_fetch_assoc($sql);
        if (sizeof($array)) {
            foreach ($array as $row) {
                $columns[] = $row["Field"];
            }
        }
        if (!in_array("enabled", $columns)) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_alert` MODIFY COLUMN message varchar(128) DEFAULT NULL, ADD COLUMN enabled CHAR(2) DEFAULT 'on' AFTER type;");
        }
        if (!in_array("method", $columns)) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_alert` ADD COLUMN method int(10) unsigned NOT NULL default '0' AFTER name");
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_alert` ADD COLUMN num int(10) unsigned NOT NULL default '1' AFTER method");
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_alert` ADD COLUMN severity INTEGER UNSIGNED NOT NULL default '0' AFTER name");
        }
        if (!in_array("command", $columns)) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_alert` ADD COLUMN command varchar(255) DEFAULT NULL AFTER email;");
        }
        /* check upgrade of syslog_alert */
        $sql = "DESCRIBE `" . $syslogdb_default . "`.`syslog_remove`";
        $columns = array();
        $array = syslog_db_fetch_assoc($sql);
        if (sizeof($array)) {
            foreach ($array as $row) {
                $columns[] = $row["Field"];
            }
        }
        if (!in_array("enabled", $columns)) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_remove` MODIFY COLUMN message varchar(128) DEFAULT NULL, ADD COLUMN enabled CHAR(2) DEFAULT 'on' AFTER type;");
        }
        if (!in_array("method", $columns)) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`syslog_remove` ADD COLUMN method CHAR(5) DEFAULT 'del' AFTER enabled;");
        }
        syslog_db_execute("DROP TABLE IF EXISTS `" . $syslogdb_default . "`.`syslog_hosts`");
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_hosts` (\n\t\t\t`host_id` int(10) unsigned NOT NULL auto_increment,\n\t\t\t`host` VARCHAR(128) NOT NULL,\n\t\t\t`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,\n\t\t\tPRIMARY KEY (`host`),\n\t\t\tKEY host_id (`host_id`),\n\t\t\tKEY last_updated (`last_updated`)) TYPE={$engine}\n\t\t\tCOMMENT='Contains all hosts currently in the syslog table'");
        syslog_db_execute("DROP TABLE IF EXISTS `" . $syslogdb_default . "`.`syslog_facilities`");
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_facilities` (\n\t\t\t`facility_id` int(10) unsigned NOT NULL auto_increment,\n\t\t\t`facility` varchar(10) NOT NULL,\n\t\t\t`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,\n\t\t\tPRIMARY KEY (`facility`),\n\t\t\tKEY facility_id (`facility_id`)) ENGINE={$engine};");
        syslog_db_execute("DROP TABLE IF EXISTS `" . $syslogdb_default . "`.`syslog_priorities`");
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_priorities` (\n\t\t\t`priority_id` int(10) unsigned NOT NULL auto_increment,\n\t\t\t`priority` varchar(10) NOT NULL,\n\t\t\t`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,\n\t\t\tPRIMARY KEY  (`priority`),\n\t\t\tKEY priority_id (`priority_id`)) ENGINE={$engine};");
        syslog_db_execute("DROP TABLE IF EXISTS `" . $syslogdb_default . "`.`syslog_host_facilities`");
        syslog_db_execute("CREATE TABLE IF NOT EXISTS `" . $syslogdb_default . "`.`syslog_host_facilities` (\n\t\t\t`host_id` int(10) unsigned NOT NULL,\n\t\t\t`facility_id` int(10) unsigned NOT NULL,\n\t\t\t`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,\n\t\t\tPRIMARY KEY  (`host_id`,`facility_id`)) ENGINE={$engine};");
        /* populate the tables */
        syslog_db_execute("INSERT INTO `" . $syslogdb_default . "`.`syslog_hosts` (host) SELECT DISTINCT host FROM `" . $syslogdb_default . "`.`{$table}`");
        syslog_db_execute("INSERT INTO `" . $syslogdb_default . "`.`syslog_facilities` (facility) SELECT DISTINCT facility FROM `" . $syslogdb_default . "`.`{$table}`");
        foreach ($syslog_levels as $id => $priority) {
            syslog_db_execute("REPLACE INTO `" . $syslogdb_default . "`.`syslog_priorities` (priority_id, priority) VALUES ({$id}, '{$priority}')");
        }
        /* a bit more horsepower please */
        syslog_db_execute("INSERT INTO `" . $syslogdb_default . "`.`syslog_host_facilities`\n\t\t\t(host_id, facility_id)\n\t\t\tSELECT host_id, facility_id\n\t\t\tFROM ((SELECT DISTINCT host, facility\n\t\t\t\tFROM `" . $syslogdb_default . "`.`{$table}`) AS s\n\t\t\t\tINNER JOIN `" . $syslogdb_default . "`.`syslog_hosts` AS sh\n\t\t\t\tON s.host=sh.host\n\t\t\t\tINNER JOIN `" . $syslogdb_default . "`.`syslog_facilities` AS sf\n\t\t\t\tON sf.facility=s.facility)");
        /* change the structure of the syslog table for performance sake */
        $mysqlVersion = syslog_get_mysql_version("syslog");
        if ($mysqlVersion >= 5) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\tMODIFY COLUMN message varchar(1024) DEFAULT NULL,\n\t\t\t\tADD COLUMN facility_id int(10) UNSIGNED NULL AFTER facility,\n\t\t\t\tADD COLUMN priority_id int(10) UNSIGNED NULL AFTER facility_id,\n\t\t\t\tADD COLUMN host_id int(10) UNSIGNED NULL AFTER priority_id,\n\t\t\t\tADD COLUMN logtime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00' AFTER priority,\n\t\t\t\tADD INDEX facility_id (facility_id),\n\t\t\t\tADD INDEX priority_id (priority_id),\n\t\t\t\tADD INDEX host_id (host_id),\n\t\t\t\tADD INDEX logtime(logtime);");
        } else {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\tADD COLUMN facility_id int(10) UNSIGNED NULL AFTER host,\n\t\t\t\tADD COLUMN priority_id int(10) UNSIGNED NULL AFTER facility_id,\n\t\t\t\tADD COLUMN host_id int(10) UNSIGNED NULL AFTER priority_id,\n\t\t\t\tADD COLUMN logtime DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00' AFTER priority,\n\t\t\t\tADD INDEX facility_id (facility_id),\n\t\t\t\tADD INDEX priority_id (priority_id),\n\t\t\t\tADD INDEX host_id (host_id),\n\t\t\t\tADD INDEX logtime(logtime);");
        }
        /* convert dates and times to timestamp */
        syslog_db_execute("UPDATE `" . $syslogdb_default . "`.`{$table}` SET logtime=TIMESTAMP(`date`, `time`)");
        /* update the host_ids */
        $hosts = syslog_db_fetch_assoc("SELECT * FROM `" . $syslogdb_default . "`.`syslog_hosts`");
        if (sizeof($hosts)) {
            foreach ($hosts as $host) {
                syslog_db_execute("UPDATE `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\tSET host_id=" . $host["host_id"] . "\n\t\t\t\tWHERE host='" . $host["host"] . "'");
            }
        }
        /* update the priority_ids */
        $priorities = $syslog_levels;
        if (sizeof($priorities)) {
            foreach ($priorities as $id => $priority) {
                syslog_db_execute("UPDATE `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\tSET priority_id=" . $id . "\n\t\t\t\tWHERE priority='" . $priority . "'");
            }
        }
        /* update the facility_ids */
        $fac = syslog_db_fetch_assoc("SELECT * FROM `" . $syslogdb_default . "`.`syslog_facilities`");
        if (sizeof($fac)) {
            foreach ($fac as $f) {
                syslog_db_execute("UPDATE `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\tSET facility_id=" . $f["facility_id"] . "\n\t\t\t\tWHERE facility='" . $f["facility"] . "'");
            }
        }
        if (!$isbackground) {
            syslog_db_execute("ALTER TABLE `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\tDROP COLUMN `date`,\n\t\t\t\tDROP COLUMN `time`,\n\t\t\t\tDROP COLUMN `host`,\n\t\t\t\tDROP COLUMN `facility`,\n\t\t\t\tDROP COLUMN `priority`");
        } else {
            while (true) {
                $fetch_size = '10000';
                $sequence = syslog_db_fetch_cell("SELECT max(seq) FROM (SELECT seq FROM `" . $syslogdb_default . "`.`{$table}` ORDER BY seq LIMIT {$fetch_size}) AS preupgrade");
                if ($sequence > 0 && $sequence != '') {
                    syslog_db_execute("INSERT INTO `" . $syslogdb_default . "`.`syslog` (facility_id, priority_id, host_id, logtime, message)\n\t\t\t\t\t\tSELECT facility_id, priority_id, host_id, logtime, message\n\t\t\t\t\t\tFROM `" . $syslogdb_default . "`.`{$table}`\n\t\t\t\t\t\tWHERE seq<{$sequence}");
                    syslog_db_execute("DELETE FROM `" . $syslogdb_default . "`.`{$table}` WHERE seq<={$sequence}");
                } else {
                    syslog_db_execute("DROP TABLE `" . $syslogdb_default . "`.`{$table}`");
                    break;
                }
            }
        }
        /* create the soft removal table */
        syslog_db_execute("DROP TABLE IF EXISTS `" . $syslogdb_default . "`.`syslog_removed`");
        syslog_db_execute("CREATE TABLE `" . $syslogdb_default . "`.`syslog_removed` LIKE `" . $syslogdb_default . "`.`syslog`");
    } else {
        include_once $config['base_path'] . "/lib/poller.php";
        $p = dirname(__FILE__);
        $command_string = read_config_option("path_php_binary");
        $extra_args = ' -q ' . $config['base_path'] . '/plugins/syslog/syslog_upgrade.php --type=' . $options["db_type"] . ' --engine=' . $engine . ' --days=' . $options["days"];
        cacti_log("SYSLOG NOTE: Launching Background Syslog Database Upgrade Process", false, "SYSTEM");
        exec_background($command_string, $extra_args);
    }
    /* reenable syslog xferral */
    set_config_option('syslog_enabled', 'on');
}
Пример #6
0
/** function syslog_messages()
 *  This is the main page display function in Syslog.  Displays all the
 *  syslog messages that are relevant to Syslog.
*/
function syslog_messages($tab = 'syslog')
{
    global $sql_where, $hostfilter, $severities;
    global $config, $syslog_incoming_config, $reset_multi, $syslog_levels;
    include dirname(__FILE__) . '/config.php';
    include './include/global_arrays.php';
    /* force the initial timespan to be 30 minutes for performance reasons */
    if (!isset($_SESSION['sess_syslog_init'])) {
        $_SESSION['sess_current_timespan'] = 1;
        $_SESSION['sess_syslog_init'] = 1;
    }
    $url_curr_page = get_browser_query_string();
    $sql_where = '';
    if (get_request_var('rows') == -1) {
        $row_limit = read_config_option('num_rows_table');
    } elseif (get_request_var('rows') == -2) {
        $row_limit = 999999;
    } else {
        $row_limit = get_request_var('rows');
    }
    $syslog_messages = get_syslog_messages($sql_where, $row_limit, $tab);
    syslog_filter($sql_where, $tab);
    if ($tab == 'syslog') {
        if (get_request_var('removal') == 1) {
            $total_rows = syslog_db_fetch_cell("SELECT SUM(totals)\n\t\t\t\tFROM (\n\t\t\t\t\tSELECT count(*) AS totals\n\t\t\t\t\tFROM `" . $syslogdb_default . "`.`syslog` AS syslog\n\t\t\t\t\t{$sql_where}\n\t\t\t\t\tUNION\n\t\t\t\t\tSELECT count(*) AS totals\n\t\t\t\t\tFROM `" . $syslogdb_default . "`.`syslog_removed` AS syslog\n\t\t\t\t\t{$sql_where}\n\t\t\t\t) AS rowcount");
        } elseif (get_request_var("removal") == -1) {
            $total_rows = syslog_db_fetch_cell("SELECT count(*) \n\t\t\t\tFROM `" . $syslogdb_default . "`.`syslog` AS syslog\n\t\t\t\t{$sql_where}");
        } else {
            $total_rows = syslog_db_fetch_cell("SELECT count(*) \n\t\t\t\tFROM `" . $syslogdb_default . "`.`syslog_removed` AS syslog\n\t\t\t\t{$sql_where}");
        }
    } else {
        $total_rows = syslog_db_fetch_cell("SELECT count(*)\n\t\t\tFROM `" . $syslogdb_default . "`.`syslog_logs` AS syslog\n\t\t\tLEFT JOIN `" . $syslogdb_default . "`.`syslog_facilities` AS sf\n\t\t\tON syslog.facility_id=sf.facility_id \n\t\t\tLEFT JOIN `" . $syslogdb_default . "`.`syslog_priorities` AS sp\n\t\t\tON syslog.priority_id=sp.priority_id \n\t\t\tLEFT JOIN `" . $syslogdb_default . "`.`syslog_alert` AS sa\n\t\t\tON syslog.alert_id=sa.id \n\t\t\tLEFT JOIN `" . $syslogdb_default . "`.`syslog_programs` AS spr\n\t\t\tON syslog.program_id=spr.program_id " . $sql_where);
    }
    if ($tab == 'syslog') {
        $nav = html_nav_bar("syslog.php?tab={$tab}", MAX_DISPLAY_PAGES, get_request_var_request('page'), $row_limit, $total_rows, 7, 'Messages', 'page', 'main');
        if (api_plugin_user_realm_auth('syslog_alerts.php')) {
            $display_text = array('nosortt' => array(__('Actions'), 'ASC'), 'logtime' => array(__('Date'), 'ASC'), 'host_id' => array(__('Host'), 'ASC'), 'program' => array(__('Program'), 'ASC'), 'message' => array(__('Message'), 'ASC'), 'facility_id' => array(__('Facility'), 'ASC'), 'priority_id' => array(__('Priority'), 'ASC'));
        } else {
            $display_text = array('logtime' => array(__('Date'), 'ASC'), 'host_id' => array(__('Host'), 'ASC'), 'program' => array(__('Program'), 'ASC'), 'message' => array(__('Message'), 'ASC'), 'facility_id' => array(__('Facility'), 'ASC'), 'priority_id' => array(__('Priority'), 'ASC'));
        }
        print $nav;
        html_start_box('', '100%', '', '3', 'center', '');
        html_header_sort($display_text, get_request_var('sort_column'), get_request_var('sort_direction'));
        $hosts = array_rekey(syslog_db_fetch_assoc('SELECT host_id, host FROM `' . $syslogdb_default . '`.`syslog_hosts`'), 'host_id', 'host');
        $facilities = array_rekey(syslog_db_fetch_assoc('SELECT facility_id, facility FROM `' . $syslogdb_default . '`.`syslog_facilities`'), 'facility_id', 'facility');
        $priorities = array_rekey(syslog_db_fetch_assoc('SELECT priority_id, priority FROM `' . $syslogdb_default . '`.`syslog_priorities`'), 'priority_id', 'priority');
        if (sizeof($syslog_messages)) {
            foreach ($syslog_messages as $syslog_message) {
                $title = htmlspecialchars($syslog_message['message'], ENT_QUOTES);
                syslog_row_color($syslog_message['priority_id'], $title);
                if (api_plugin_user_realm_auth('syslog_alerts.php')) {
                    print "<td class='nowrap left' style='width:1%:padding:1px !important;'>";
                    if ($syslog_message['mtype'] == 'main') {
                        print "<a style='padding:1px' href='" . htmlspecialchars('syslog_alerts.php?id=' . $syslog_message[$syslog_incoming_config['id']] . '&action=newedit&type=0') . "'><img src='images/add.png' border='0'></a>\n\t\t\t\t\t\t<a style='padding:1px' href='" . htmlspecialchars('syslog_removal.php?id=' . $syslog_message[$syslog_incoming_config['id']] . '&action=newedit&type=new&type=0') . "'><img src='images/delete.png' border='0'></a>\n";
                    }
                    print "</td>\n";
                }
                print '<td class="left nowrap">' . $syslog_message['logtime'] . "</td>\n";
                print '<td class="left nowrap">' . $hosts[$syslog_message['host_id']] . "</td>\n";
                print '<td class="left nowrap">' . $syslog_message['program'] . "</td>\n";
                print '<td class="left syslogMessage">' . filter_value(title_trim($syslog_message[$syslog_incoming_config['textField']], get_request_var_request('trimval')), get_request_var('filter')) . "</td>\n";
                print '<td class="left nowrap">' . ucfirst($facilities[$syslog_message['facility_id']]) . "</td>\n";
                print '<td class="left nowrap">' . ucfirst($priorities[$syslog_message['priority_id']]) . "</td>\n";
            }
        } else {
            print "<tr><td class='center' colspan='7'><em>" . __('No Syslog Messages') . "</em></td></tr>";
        }
        html_end_box(false);
        if (sizeof($syslog_messages)) {
            print $nav;
        }
        syslog_syslog_legend();
        print "<script type='text/javascript'>\$(function() { \$('button').tooltip({ closed: true }).on('focus', function() { \$('#filter').tooltip('close') }).on('click', function() { \$(this).tooltip('close'); }); })</script>\n";
    } else {
        $nav = html_nav_bar("syslog.php?tab={$tab}", MAX_DISPLAY_PAGES, get_request_var_request('page'), $row_limit, $total_rows, 8, 'Alert Log Rows', 'page', 'main');
        print $nav;
        $display_text = array('name' => array('display' => __('Alert Name'), 'sort' => 'ASC', 'align' => 'left'), 'severity' => array('display' => __('Severity'), 'sort' => 'ASC', 'align' => 'left'), 'logtime' => array('display' => __('Date'), 'sort' => 'ASC', 'align' => 'left'), 'logmsg' => array('display' => __('Message'), 'sort' => 'ASC', 'align' => 'left'), 'count' => array('display' => __('Count'), 'sort' => 'ASC', 'align' => 'right'), 'host' => array('display' => __('Host'), 'sort' => 'ASC', 'align' => 'right'), 'facility_id' => array('display' => __('Facility'), 'sort' => 'ASC', 'align' => 'right'), 'priority_id' => array('display' => __('Priority'), 'sort' => 'ASC', 'align' => 'right'));
        html_start_box('', '100%', '', '3', 'center', '');
        html_header_sort($display_text, get_request_var('sort_column'), get_request_var('sort_direction'));
        if (sizeof($syslog_messages)) {
            foreach ($syslog_messages as $log) {
                $title = htmlspecialchars($log['logmsg'], ENT_QUOTES);
                syslog_row_color($log['severity'], $title);
                print "<td class='left'><a class='linkEditMain' href='" . htmlspecialchars($config['url_path'] . 'plugins/syslog/syslog.php?id=' . $log['seq'] . '&tab=current') . "'>" . (strlen($log['name']) ? $log['name'] : 'Alert Removed') . "</a></td>\n";
                print '<td class="left nowrap">' . (isset($severities[$log['severity']]) ? $severities[$log['severity']] : 'Unknown') . "</td>\n";
                print '<td class="left nowrap">' . $log['logtime'] . "</td>\n";
                print '<td class="left syslogMessage">' . filter_value(title_trim($log['logmsg'], get_request_var_request('trimval')), get_request_var('filter')) . "</td>\n";
                print '<td class="right nowrap">' . $log['count'] . "</td>\n";
                print '<td class="right nowrap">' . $log['host'] . "</td>\n";
                print '<td class="right nowrap">' . ucfirst($log['facility']) . "</td>\n";
                print '<td class="right nowrap">' . ucfirst($log['priority']) . "</td>\n";
                print "</tr>\n";
            }
        } else {
            print "<tr><td colspan='11'><em>" . __('No Alert Log Messages') . "</em></td></tr>";
        }
        html_end_box(false);
        if (sizeof($syslog_messages)) {
            print $nav;
        }
        syslog_log_legend();
    }
}
Пример #7
0
function syslog_manage_items($from_table, $to_table)
{
    global $config, $syslog_cnn, $syslog_incoming_config;
    include dirname(__FILE__) . "/config.php";
    /* Select filters to work on */
    $rows = syslog_db_fetch_assoc("SELECT * FROM `" . $syslogdb_default . "`.`syslog_remove` WHERE enabled='on'");
    //$rows = syslog_db_fetch_assoc("SELECT * FROM `" . $syslogdb_default . "`.`syslog_remove` WHERE enabled='on' AND message like 'last message repeated %'");
    syslog_debug("Found   " . sizeof($rows) . ",  Removal Rule(s)" . " to process");
    $removed = 0;
    $xferred = 0;
    $total = 0;
    if (sizeof($rows)) {
        foreach ($rows as $remove) {
            syslog_debug("Processing Rule  - " . $remove['message']);
            $sql_sel = "";
            $sql_dlt = "";
            if ($remove['type'] == 'facility') {
                if ($remove['method'] != 'del') {
                    $sql_sel = "SELECT seq\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table}\n\t\t\t\t\t\t\t\tWHERE facility_id in\n\t\t\t\t\t\t\t\t\t(SELECT distinct facility_id from `" . $syslogdb_default . "`syslog_facilities\n\t\t\t\t\t\t\t\t\t\tWHERE facility ='" . $remove['message'] . "')";
                } else {
                    $sql_dlt = "DELETE\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table} \n\t\t\t\t\t\t\t\tWHERE facility_id in\n\t\t\t\t\t\t\t\t\t(SELECT distinct facility_id from `" . $syslogdb_default . "`syslog_facilities\n\t\t\t\t\t\t\t\t\t\tWHERE facility ='" . $remove['message'] . "')";
                }
            } else {
                if ($remove['type'] == 'host') {
                    if ($remove['method'] != 'del') {
                        $sql_sel = "SELECT seq\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table}\n\t\t\t\t\t\t\t\tWHERE host_id in\n\t\t\t\t\t\t\t\t\t(SELECT distinct host_id from `" . $syslogdb_default . "`syslog_hosts\n\t\t\t\t\t\t\t\t\t\tWHERE host ='" . $remove['message'] . "')";
                    } else {
                        $sql_dlt = "DELETE\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table} \n\t\t\t\t\t\t\t\tWHERE host_id in\n\t\t\t\t\t\t\t\t\t(SELECT distinct host_id from `" . $syslogdb_default . "`syslog_hosts\n\t\t\t\t\t\t\t\t\t\tWHERE host ='" . $remove['message'] . "')";
                    }
                } else {
                    if ($remove['type'] == 'messageb') {
                        if ($remove['method'] != 'del') {
                            $sql_sel = "SELECT seq\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table}\n\t\t\t\t\t\t\t\tWHERE message LIKE '" . $remove['message'] . "%' ";
                        } else {
                            $sql_dlt = "DELETE\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table} \n\t\t\t\t\t\t\t\tWHERE message LIKE '" . $remove['message'] . "%' ";
                        }
                    } else {
                        if ($remove['type'] == 'messagec') {
                            if ($remove['method'] != 'del') {
                                $sql_sel = "SELECT seq\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table}\n\t\t\t\t\t\t\t\tWHERE message LIKE '%" . $remove['message'] . "%' ";
                            } else {
                                $sql_dlt = "DELETE\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table} \n\t\t\t\t\t\t\t\tWHERE message LIKE '%" . $remove['message'] . "%' ";
                            }
                        } else {
                            if ($remove['type'] == 'messagee') {
                                if ($remove['method'] != 'del') {
                                    $sql_sel = "SELECT seq\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table}\n\t\t\t\t\t\t\t\tWHERE message LIKE '%" . $remove['message'] . "' ";
                                } else {
                                    $sql_dlt = "DELETE\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table} \n\t\t\t\t\t\t\t\tWHERE message LIKE '%" . $remove['message'] . "' ";
                                }
                            } else {
                                if ($remove['type'] == 'sql') {
                                    if ($remove['method'] != 'del') {
                                        $sql_sel = "SELECT seq\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table}\n\t\t\t\t\t\t\t\tWHERE message (" . $remove['message'] . ") ";
                                    } else {
                                        $sql_dlt = "DELETE\n\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`. {$from_table} \n\t\t\t\t\t\t\t\tWHERE message (" . $remove['message'] . ") ";
                                    }
                                }
                            }
                        }
                    }
                }
            }
            if ($sql_sel != '' || $sql_dlt != '') {
                $debugm = '';
                /* process the removal rule first */
                if ($sql_sel != '') {
                    $move_count = 0;
                    /* first insert, then delete */
                    $move_records = syslog_db_fetch_assoc($sql_sel);
                    syslog_debug("Found   " . sizeof($move_records) . " Message(s)");
                    if (sizeof($move_records)) {
                        $all_seq = '';
                        $messages_moved = 0;
                        foreach ($move_records as $move_record) {
                            $all_seq = $all_seq . ", " . $move_record['seq'];
                        }
                        $all_seq = eregi_replace('^,', '', $all_seq);
                        syslog_db_execute("INSERT INTO `" . $syslogdb_default . "`.`" . $to_table . "` \n\t\t\t\t\t\t\t\t\t\t\t\t(facility_id, priority_id, host_id, logtime, message)\n\t\t\t\t\t\t\t\t\t\t\t\t(SELECT facility_id, priority_id, host_id, logtime, message \n\t\t\t\t\t\t\t\t\t\t\t\t\tFROM `" . $syslogdb_default . "`." . $from_table . "\n\t\t\t\t\t\t\t\t\t\t\t\t\tWHERE seq in (" . $all_seq . "))");
                        $messages_moved = $syslog_cnn->Affected_Rows();
                        if ($messages_moved > 0) {
                            syslog_db_execute("DELETE FROM `" . $syslogdb_default . "`.`" . $from_table . "` \n\t\t\t\t\t\t\t\t\t\t\t\t\tWHERE seq in (" . $all_seq . ")");
                        }
                        $xferred += $messages_moved;
                        $move_count = $messages_moved;
                    }
                    $debugm = "Moved   " . $move_count . " Message(s)";
                }
                if ($sql_dlt != '') {
                    /* now delete the remainder that match */
                    syslog_db_execute($sql_dlt);
                    $removed += $syslog_cnn->Affected_Rows();
                    $debugm = "Deleted " . $removed . " Message(s)";
                }
                syslog_debug($debugm);
            }
        }
    }
    return array("removed" => $removed, "xferred" => $xferred);
}