- GRAYBYTE UNDETECTABLE CODES -

403Webshell
Server IP : 184.154.167.98  /  Your IP : 3.22.75.92
Web Server : Apache
System : Linux pink.dnsnetservice.com 4.18.0-553.22.1.lve.1.el8.x86_64 #1 SMP Tue Oct 8 15:52:54 UTC 2024 x86_64
User : puertode ( 1767)
PHP Version : 8.2.26
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /usr/libexec/pcp/pmdas/rsyslog/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /usr/libexec/pcp/pmdas/rsyslog/pmdarsyslog.pl
#
# Copyright (c) 2012-2013 Red Hat.
# Copyright (c) 2011 Aconex.  All Rights Reserved.
#
# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#

use strict;
use warnings;
use PCP::PMDA;

my $pmda = PCP::PMDA->new('rsyslog', 107);
my $statsfile = pmda_config('PCP_LOG_DIR') . '/rsyslog/stats';
my ($es_connfail, $es_submits, $es_failed, $es_success) = (0,0,0,0);
my ($es_failed_http, $es_failed_httprequests, $es_failed_es) = (0,0,0);
my ($es_response_bad, $es_response_duplicate, $es_response_badargument, $es_response_bulkrejection, $es_response_other) = (0,0,0,0,0);
my $es_rebinds = 0;
my ($ux_submitted, $ux_discarded, $ux_ratelimiters) = (0,0,0);
my ($interval, $lasttime) = (0,0);
my ($unrecog, $ignored) = (0,0);
my ($ru_utime, $ru_stime, $ru_maxrss, $ru_minflt, $ru_majflt, $ru_inblock, $ru_oublock, $ru_nvcsw, $ru_nivcsw, $ru_openfiles) = (0,0,0,0,0,0,0,0,0,0);

my $queue_indom = 0;
my @queue_insts = ();
use vars qw(%queue_ids %queue_values);

my $unrec_origin_indom = 1;
my @unrec_origin_insts = ();
use vars qw(%unrec_origin_ids %unrec_origin_values);

my $unmat_origin_indom = 2;
my @unmat_origin_insts = ();
use vars qw(%unmat_origin_ids %unmat_origin_values);

my $action_indom = 3;
my @action_insts = ();
use vars qw(%action_ids %action_values);

my $udp_indom = 4;
my @udp_insts = ();
use vars qw(%udp_ids %udp_values);

my $udpt_indom = 5;
my @udpt_insts = ();
use vars qw(%udpt_ids %udpt_values);

my $ptcp_indom = 6;
my @ptcp_insts = ();
use vars qw(%ptcp_ids %ptcp_values);
my ($ptcp_iowq_enqueued, $ptcp_iowq_maxqsize) = (0,0);

my $fwd_indom = 7;
my @fwd_insts = ();
use vars qw(%fwd_ids %fwd_values);

sub unmatched_origin
{
    my $origin = $1;
    my $oid = undef;

    if (!defined($unmat_origin_ids{$origin})) {
	$oid = @unmat_origin_insts / 2;
	$unmat_origin_ids{$origin} = $oid;
	$unmat_origin_values{$origin} = [ 0 ];
	push @unmat_origin_insts, ($oid, $origin);
	$pmda->replace_indom($unmat_origin_indom, \@unmat_origin_insts);
    }
    $unmat_origin_values{$origin}[0]++;
}

sub rsyslog_parser
{
    ( undef, $_ ) = @_;

    #$pmda->log("rsyslog_parser got line: $_");
    if (! m|rsyslogd-pstats:|) {
	# Not a log entry we can process
	$ignored++;
	return;
    }

    my $timenow = time;
    if ($lasttime != 0) {
	if ($timenow > $lasttime) {
	    $interval = $timenow - $lasttime;
	    $lasttime = $timenow;
	}
    } else {
	$lasttime = $timenow;
    }

    if (m| origin=(.*?) |) {
	# "Modern" statistics
	my $origin = $1;

	if ($origin eq "imuxsock") {
	    if (m| submitted=(\d+) ratelimit\.discarded=(\d+) ratelimit\.numratelimiters=(\d+)|) {
		# Modern capture of the imuxsock action data
		($ux_submitted, $ux_discarded, $ux_ratelimiters) = ($1,$2,$3);
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "omelasticsearch") {
	    if (m| submitted=(\d+) failed\.http=(\d+) failed\.httprequests=(\d+) failed\.checkConn=(\d+) failed\.es=(\d+) response\.success=(\d+) response\.bad=(\d+) response\.duplicate=(\d+) response\.badargument=(\d+) response\.bulkrejection=(\d+) response\.other=(\d+) rebinds=(\d+)|) {
		# Modern capture of the omelasticsearch action data
		my $submitted = $1;
		my $failed_http = $2;
		my $failed_httprequests = $3;
		my $failed_checkConn = $4;
		my $failed_es = $5;
		my $response_success = $6;
		my $response_bad = $7;
		my $response_duplicate = $8;
		my $response_badargument = $9;
		my $response_bulkrejection = $10;
		my $response_other = $11;
		my $rebinds = $12;
		($es_connfail, $es_submits, $es_failed, $es_success) = (
		    $failed_checkConn, $submitted, ($failed_http + $failed_httprequests + $failed_es + $response_bad + $response_duplicate + $response_badargument + $response_bulkrejection + $response_other), $response_success
		);
		# New
		($es_failed_http, $es_failed_httprequests, $es_failed_es) = ($failed_http, $failed_httprequests, $failed_es);
		($es_response_bad, $es_response_duplicate, $es_response_badargument, $es_response_bulkrejection, $es_response_other) = (
		    $response_bad, $response_duplicate, $response_badargument, $response_bulkrejection, $response_other
		);
		$es_rebinds = $rebinds;
	    }
	    elsif (m| submitted=(\d+) failed\.http=(\d+) failed\.httprequests=(\d+) failed\.checkConn=(\d+) failed\.es=(\d+) response\.success=(\d+) response\.bad=(\d+) response\.duplicate=(\d+) response\.badargument=(\d+) response\.bulkrejection=(\d+) response\.other=(\d+)|) {
		# Modern capture of the omelasticsearch action data
		my $submitted = $1;
		my $failed_http = $2;
		my $failed_httprequests = $3;
		my $failed_checkConn = $4;
		my $failed_es = $5;
		my $response_success = $6;
		my $response_bad = $7;
		my $response_duplicate = $8;
		my $response_badargument = $9;
		my $response_bulkrejection = $10;
		my $response_other = $11;
		($es_connfail, $es_submits, $es_failed, $es_success) = (
		    $failed_checkConn, $submitted, ($failed_http + $failed_httprequests + $failed_es + $response_bad + $response_duplicate + $response_badargument + $response_bulkrejection + $response_other), $response_success
		);
		# New
		($es_failed_http, $es_failed_httprequests, $es_failed_es) = ($failed_http, $failed_httprequests, $failed_es);
		($es_response_bad, $es_response_duplicate, $es_response_badargument, $es_response_bulkrejection, $es_response_other) = (
		    $response_bad, $response_duplicate, $response_badargument, $response_bulkrejection, $response_other
		);
	    }
	    elsif (m| submitted=(\d+) failed\.http=(\d+) failed\.httprequests=(\d+) failed\.checkConn=(\d+) failed\.es=(\d+)|) {
		# Psuedo-modern capture of the omelasticsearch action data
		my $submitted = $1;
		my $failed_http = $2;
		my $failed_httprequests = $3;
		my $failed_checkConn = $4;
		my $failed_es = $5;
		($es_connfail, $es_submits, $es_failed, $es_success) = ($failed_checkConn, $submitted, ($failed_http + $failed_httprequests + $failed_es), 0);
		# New
		($es_failed_http, $es_failed_httprequests, $es_failed_es) = ($failed_http, $failed_httprequests, $failed_es);
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "impstats") {
	    if (m| utime=(\d+) stime=(\d+) maxrss=(\d+) minflt=(\d+) majflt=(\d+) inblock=(\d+) oublock=(\d+) nvcsw=(\d+) nivcsw=(\d+) openfiles=(\d+)|) {
		($ru_utime, $ru_stime, $ru_maxrss, $ru_minflt, $ru_majflt, $ru_inblock, $ru_oublock, $ru_nvcsw, $ru_nivcsw, $ru_openfiles) = ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10);
	    }
	    elsif (m| utime=(\d+) stime=(\d+) maxrss=(\d+) minflt=(\d+) majflt=(\d+) inblock=(\d+) oublock=(\d+) nvcsw=(\d+) nivcsw=(\d+)|) {
		($ru_utime, $ru_stime, $ru_maxrss, $ru_minflt, $ru_majflt, $ru_inblock, $ru_oublock, $ru_nvcsw, $ru_nivcsw, $ru_openfiles) = ($1,$2,$3,$4,$5,$6,$7,$8,$9,0);
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "core.queue") {
	    if (m|pstats: (.+): origin=core\.queue size=(\d+) enqueued=(\d+) full=(\d+) discarded\.full=(\d+) discarded\.nf=(\d+) maxqsize=(\d+)|) {
		# Modern capture of queue data
		my ($qname, $qid) = ($1, undef);

		if (!defined($queue_ids{$qname})) {
		    $qid = @queue_insts / 2;
		    $queue_ids{$qname} = $qid;
		    push @queue_insts, ($qid, $qname);
		    $pmda->replace_indom($queue_indom, \@queue_insts);
		}
		$queue_values{$qname} = [ $2, $3, $4, $7, $5, $6 ];
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "core.action") {
	    if (m|pstats: (.+): origin=core\.action processed=(\d+) failed=(\d+) suspended=(\d+) suspended\.duration=(\d+) resumed=(\d+)|) {
		# Modern capture of action data
		my ($aname, $aid) = ($1, undef);

		if (!defined($action_ids{$aname})) {
		    $aid = @action_insts / 2;
		    $action_ids{$aname} = $aid;
		    push @action_insts, ($aid, $aname);
		    $pmda->replace_indom($action_indom, \@action_insts);
		}
		$action_values{$aname} = [ $2, $3, $4, $5, $6 ];
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "imudp") {
	    if (m|pstats: imudp\((.+)\): origin=imudp submitted=(\d+) disallowed=(\d+)|) {
		# Modern capture of imudp data
		my ($udpname, $udpid) = ($1, undef);

		if (!defined($udp_ids{$udpname})) {
		    $udpid = @udp_insts / 2;
		    $udp_ids{$udpname} = $udpid;
		    push @udp_insts, ($udpid, $udpname);
		    $pmda->replace_indom($udp_indom, \@udp_insts);
		}
		$udp_values{$udpname} = [ $2, $3 ];
	    }
	    elsif (m|pstats: imudp\((.+)\): origin=imudp submitted=(\d+)|) {
		# Modern capture of imudp data
		my ($udpname, $udpid) = ($1, undef);

		if (!defined($udp_ids{$udpname})) {
		    $udpid = @udp_insts / 2;
		    $udp_ids{$udpname} = $udpid;
		    push @udp_insts, ($udpid, $udpname);
		    $pmda->replace_indom($udp_indom, \@udp_insts);
		}
		$udp_values{$udpname} = [ $2, 0 ];
	    }
	    elsif (m|pstats: imudp\((.+)\): origin=imudp called\.recvmmsg=(\d+) called\.recvmsg=(\d+) msgs\.received=(\d+)|) {
		# Modern capture of imudp *thread* data
		my ($utname, $utid) = ($1, undef);

		if (!defined($udpt_ids{$utname})) {
		    $utid = @udpt_insts / 2;
		    $udpt_ids{$utname} = $utid;
		    push @udpt_insts, ($utid, $utname);
		    $pmda->replace_indom($udpt_indom, \@udpt_insts);
		}
		$udpt_values{$utname} = [ $2, $3, $4 ];
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "imptcp") {
	    if (m|pstats: imptcp\((.+)\): origin=imptcp submitted=(\d+) sessions\.opened=(\d+) sessions\.openfailed=(\d+) sessions\.closed=(\d+) bytes\.received=(\d+) bytes\.decompressed=(\d+)|) {
		# Modern capture of imptcp data
		my ($ptcpname, $ptcpid) = ($1, undef);

		if (!defined($ptcp_ids{$ptcpname})) {
		    $ptcpid = @ptcp_insts / 2;
		    $ptcp_ids{$ptcpname} = $ptcpid;
		    push @ptcp_insts, ($ptcpid, $ptcpname);
		    $pmda->replace_indom($ptcp_indom, \@ptcp_insts);
		}
		$ptcp_values{$ptcpname} = [ $2, $3, $4, $5, $6, $7 ];
	    }
	    elsif (m|pstats: imptcp\((.+)\): origin=imptcp submitted=(\d+) bytes\.received=(\d+) bytes\.decompressed=(\d+)|) {
		# Modern capture of imptcp data
		my ($ptcpname, $ptcpid) = ($1, undef);

		if (!defined($ptcp_ids{$ptcpname})) {
		    $ptcpid = @ptcp_insts / 2;
		    $ptcp_ids{$ptcpname} = $ptcpid;
		    push @ptcp_insts, ($ptcpid, $ptcpname);
		    $pmda->replace_indom($ptcp_indom, \@ptcp_insts);
		}
		$ptcp_values{$ptcpname} = [ $2, 0, 0, 0, $3, $4 ];
	    }
	    elsif (m|pstats: io-work-q: origin=imptcp enqueued=(\d+) maxqsize=(\d+)|) {
		($ptcp_iowq_enqueued, $ptcp_iowq_maxqsize) = ($1, $2);
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	elsif ($origin eq "omfwd") {
	    if (m|pstats: (.+): origin=omfwd bytes\.sent=(\d+)|) {
		# Modern capture of omfwd data
		my ($fwdname, $fwdid) = ($1, undef);

		if (!defined($fwd_ids{$fwdname})) {
		    $fwdid = @fwd_insts / 2;
		    $fwd_ids{$fwdname} = $fwdid;
		    push @fwd_insts, ($fwdid, $fwdname);
		    $pmda->replace_indom($fwd_indom, \@fwd_insts);
		}
		$fwd_values{$fwdname} = [ $2 ];
	    }
	    else {
		unmatched_origin($origin);
	    }
	}
	else {
	    # Count unrecognized origin values.
	    my $oid = undef;

	    if (!defined($unrec_origin_ids{$origin})) {
		$oid = @unrec_origin_insts / 2;
		$unrec_origin_ids{$origin} = $oid;
		$unrec_origin_values{$origin} = [ 0 ];
		push @unrec_origin_insts, ($oid, $origin);
		$pmda->replace_indom($unrec_origin_indom, \@unrec_origin_insts);
	    }
	    $unrec_origin_values{$origin}[0]++;
	}
    }
    elsif (m|imuxsock: submitted=(\d+) ratelimit\.discarded=(\d+) ratelimit\.numratelimiters=(\d+)|) {
	# Legacy capture of the imuxsock action data
	($ux_submitted, $ux_discarded, $ux_ratelimiters) = ($1,$2,$3);
    }
    elsif (m|elasticsearch: connfail=(\d+) submits=(\d+) failed=(\d+) success=(\d+)|) {
	# Legacy capture of the omelasticsearch action data
	($es_connfail, $es_submits, $es_failed, $es_success) = ($1,$2,$3,$4);
    }
    elsif (m|pstats: (.+): size=(\d+) enqueued=(\d+) full=(\d+) maxqsize=(\d+)|) {
	# Legacy capture of queue data
	my ($qname, $qid) = ($1, undef);

	if (!defined($queue_ids{$qname})) {
	    $qid = @queue_insts / 2;
	    $queue_ids{$qname} = $qid;
	    push @queue_insts, ($qid, $qname);
	    $pmda->replace_indom($queue_indom, \@queue_insts);
	}
	$queue_values{$qname} = [ $2, $3, $4, $5, 0, 0 ];
    }
    else {
	# Count of unrecognized rsyslog-pstats log lines.
	$unrecog++;
    }
}

sub rsyslog_fetch_callback
{
    my ($cluster, $item, $inst) = @_;

    #$pmda->log("rsyslog_fetch_callback for PMID: $cluster.$item ($inst)");

    return (PM_ERR_AGAIN,0) unless ($interval != 0);

    if ($cluster == 0) {
	return (PM_ERR_INST, 0) unless ($inst == PM_IN_NULL);
	if ($item == 0) { return ($interval, 1); }

	if ($item == 1) { return ($ux_submitted, 1); }
	if ($item == 2) { return ($ux_discarded, 1); }
	if ($item == 3) { return ($ux_ratelimiters, 1); }

	if ($item == 8) { return ($es_connfail, 1); }
	if ($item == 9) { return ($es_submits, 1); }
	if ($item == 10){ return ($es_failed, 1); }
	if ($item == 11){ return ($es_success, 1); }

	if ($item == 12){ return ($unrecog, 1); }
	if ($item == 13){ return ($ignored, 1); }

	if ($item == 14){ return ($es_failed_http, 1); }
	if ($item == 15){ return ($es_failed_httprequests, 1); }
	if ($item == 16){ return ($es_failed_es, 1); }
	if ($item == 17){ return ($es_response_bad, 1); }
	if ($item == 18){ return ($es_response_duplicate, 1); }
	if ($item == 19){ return ($es_response_badargument, 1); }
	if ($item == 20){ return ($es_response_bulkrejection, 1); }
	if ($item == 21){ return ($es_response_other, 1); }
	if ($item == 22){ return ($es_rebinds, 1); }

	if ($item == 23){ return ($ru_utime, 1); }
	if ($item == 24){ return ($ru_stime, 1); }
	if ($item == 25){ return ($ru_maxrss, 1); }
	if ($item == 26){ return ($ru_minflt, 1); }
	if ($item == 27){ return ($ru_majflt, 1); }
	if ($item == 28){ return ($ru_inblock, 1); }
	if ($item == 29){ return ($ru_oublock, 1); }
	if ($item == 30){ return ($ru_nvcsw, 1); }
	if ($item == 31){ return ($ru_nivcsw, 1); }
	if ($item == 32){ return ($ru_openfiles, 1); }

	if ($item == 33){ return ($ptcp_iowq_enqueued, 1); }
	if ($item == 34){ return ($ptcp_iowq_maxqsize, 1); }
    }
    elsif ($cluster == 1) {	# queues
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @queue_insts);

	my $qname = $queue_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($qname);

	my $qvref = $queue_values{$qname};
	return (PM_ERR_INST, 0) unless defined ($qvref);

	my @qvals = @$qvref;
	if ($item == 0) { return ($qvals[0], 1); }
	if ($item == 1) { return ($qvals[1], 1); }
	if ($item == 2) { return ($qvals[2], 1); }
	if ($item == 3) { return ($qvals[3], 1); }
	if ($item == 4) { return ($qvals[4], 1); }
	if ($item == 5) { return ($qvals[5], 1); }
    }
    elsif ($cluster == 2) {	# unrecognized origins
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @unrec_origin_insts);

	my $unoname = $unrec_origin_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($unoname);

	my $unovref = $unrec_origin_values{$unoname};
	return (PM_ERR_INST, 0) unless defined ($unovref);

	my @unovals = @$unovref;
	if ($item == 0) { return ($unovals[0], 1); }
    }
    elsif ($cluster == 3) {	# unmatched origins
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @unmat_origin_insts);

	my $umoname = $unmat_origin_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($umoname);

	my $umovref = $unmat_origin_values{$umoname};
	return (PM_ERR_INST, 0) unless defined ($umovref);

	my @umovals = @$umovref;
	if ($item == 0) { return ($umovals[0], 1); }
    }
    elsif ($cluster == 4) {	# actions
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @action_insts);

	my $aname = $action_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($aname);

	my $avref = $action_values{$aname};
	return (PM_ERR_INST, 0) unless defined ($avref);

	my @avals = @$avref;
	if ($item == 0) { return ($avals[0], 1); }
	if ($item == 1) { return ($avals[1], 1); }
	if ($item == 2) { return ($avals[2], 1); }
	if ($item == 3) { return ($avals[3], 1); }
	if ($item == 4) { return ($avals[4], 1); }
    }
    elsif ($cluster == 5) {	# udp
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @udp_insts);

	my $uname = $udp_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($uname);

	my $uvref = $udp_values{$uname};
	return (PM_ERR_INST, 0) unless defined ($uvref);

	my @uvals = @$uvref;
	if ($item == 0) { return ($uvals[0], 1); }
	if ($item == 1) { return ($uvals[1], 1); }
    }
    elsif ($cluster == 6) {	# udp.thread
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @udpt_insts);

	my $utname = $udpt_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($utname);

	my $utvref = $udpt_values{$utname};
	return (PM_ERR_INST, 0) unless defined ($utvref);

	my @utvals = @$utvref;
	if ($item == 0) { return ($utvals[0], 1); }
	if ($item == 1) { return ($utvals[1], 1); }
	if ($item == 2) { return ($utvals[2], 1); }
    }
    elsif ($cluster == 7) {	# ptcp
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @ptcp_insts);

	my $pname = $ptcp_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($pname);

	my $pvref = $ptcp_values{$pname};
	return (PM_ERR_INST, 0) unless defined ($pvref);

	my @pvals = @$pvref;
	if ($item == 0) { return ($pvals[0], 1); }
	if ($item == 1) { return ($pvals[1], 1); }
	if ($item == 2) { return ($pvals[2], 1); }
	if ($item == 3) { return ($pvals[3], 1); }
	if ($item == 4) { return ($pvals[4], 1); }
	if ($item == 5) { return ($pvals[5], 1); }
    }
    elsif ($cluster == 8) {	# fwd
	return (PM_ERR_INST, 0) unless ($inst != PM_IN_NULL);
	return (PM_ERR_INST, 0) unless ($inst <= @fwd_insts);

	my $fname = $fwd_insts[$inst * 2 + 1];
	return (PM_ERR_INST, 0) unless defined ($fname);

	my $fvref = $fwd_values{$fname};
	return (PM_ERR_INST, 0) unless defined ($fvref);

	my @fvals = @$fvref;
	if ($item == 0) { return ($fvals[0], 1); }
    }
    return (PM_ERR_PMID, 0);
}

die "Cannot find a valid rsyslog statistics named pipe: " . $statsfile . "\n" unless -p $statsfile;

$pmda->connect_pmcd;

$pmda->add_metric(pmda_pmid(0,0), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_INSTANT,
	pmda_units(0,1,0,0,PM_TIME_SEC,PM_COUNT_ONE), 'rsyslog.interval',
	'Time interval observed between samples', '');

$pmda->add_metric(pmda_pmid(0,1), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.imuxsock.submitted',
	'Cumulative count of unix domain socket input messages queued',
	"Cumulative count of messages successfully queued to the rsyslog\n" .
	"main message queueing core that arrived on unix domain sockets.");
$pmda->add_metric(pmda_pmid(0,2), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.imuxsock.discarded',
	'Count of unix domain socket messages discarded due to rate limiting',
	"Cumulative count of messages that are were discarded due to their\n" .
	"priority being at or below rate-limit-severity and their sending\n" .
	"process being deemed to be sending messages too quickly (refer to\n" .
	"parameters ratelimitburst, ratelimitinterval and ratelimitseverity");
$pmda->add_metric(pmda_pmid(0,3), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.imuxsock.numratelimiters',
	'Count of messages received that could be subject to rate limiting',
	"Cumulative count of messages that rsyslog received and performed a\n" .
	"credentials (PID) lookup for subsequent rate limiting decisions.\n" .
	"The message would have to be at rate-limit-severity or lower, with\n" .
	"rate limiting enabled, in order for this count to be incremented.");

$pmda->add_metric(pmda_pmid(0,8), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.connfail',
	'Count of failed connections while attempting to send events',
	"Number of times rsyslog detected a connection loss via a HTTP health" .
	"check (either the 'connfail' or 'failed.checkConn' metric).");
$pmda->add_metric(pmda_pmid(0,9), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.submits',
	'Count of valid submissions of events to elasticsearch',
	"Number of messages submitted for processing (with both success and\n" .
	" error result; either the 'submits' or 'submitted' metric).");
$pmda->add_metric(pmda_pmid(0,10), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.failed',
	'Count of failed attempts to send events to elasticsearch',
	"This count is often a good indicator of malformed JSON messages\n" .
	"(is either the 'failed' metric, or a combination of the 'failed.es',\n" .
	"'failed.http', 'failed.httprequests', 'response.bad', 'response.duplicate',\n" .
	"'response.badargument', 'response.bulkrejection', and 'response.other'\n" .
	"metrics).");
$pmda->add_metric(pmda_pmid(0,11), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.success',
	'Count of successfully acknowledged events from elasticsearch',
	"Number of records successfully sent in bulk index requests - counts\n" .
	"the number of successful responses.  Note that this reflects the value\n" .
	"of the 'success' metric, or the 'response.success', when present.");

$pmda->add_metric(pmda_pmid(0,12), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.impstats.ignored',
	'Count of impstats log lines ignored', '');
$pmda->add_metric(pmda_pmid(0,13), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.impstats.unrecog',
	'Count of unrecognized impstas log lines', '');

$pmda->add_metric(pmda_pmid(0,14), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.failure.http',
	'Count of message failures due to connection like-problems', "");
$pmda->add_metric(pmda_pmid(0,15), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.failure.httprequests',
	'Count of http request failures',
	"The count of http request failures. Note that a single http request\n" .
	"may be used to submit multiple messages, so this number may be (much)\n" .
	"lower than failed.http.");
$pmda->add_metric(pmda_pmid(0,16), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.failure.es',
	'Count of failures due to Elasticsearch error replies',
	"The count of failures due to error responses from Elasticsearch. Note\n" .
	"that this counter does NOT count the number of failed messages but\n" .
	"the number of times a failure occurred (a potentially much smaller\n" .
	"number).");
$pmda->add_metric(pmda_pmid(0,17), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.response.bad',
	'Count of unrecognized responses from Elasticsearch',
	"The count of times omelasticsearch received a response in a bulk index\n" .
	"response that was unrecognized or unable to be parsed. This may indicate\n" .
	"that omelasticsearch is attempting to communicate with a version of\n" .
	"Elasticsearch that is incompatible, or is otherwise sending back data\n" .
	"in the response that cannot be handled.");
$pmda->add_metric(pmda_pmid(0,18), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.response.duplicate',
	'Count of duplicate records detected by Elasticsearch',
	"The count of records in the bulk index request that were duplicates of\n" .
	"already existing records - this will only be reported if using\n" .
	"writeoperation='create' and 'bulkid' to assign each record a unique ID");
$pmda->add_metric(pmda_pmid(0,19), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.response.badargument',
	'Count of bad data sent by omelasticsearch',
	"The count of times omelasticsearch received a response that had a\n" .
	"status indicating omelasticsearch sent bad data to Elasticsearch. For\n" .
	"example, status 400 and an error message indicating omelasticsearch\n" .
	"attempted to store a non-numeric string value in a numeric field.");
$pmda->add_metric(pmda_pmid(0,20), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.response.bulkrejection',
	'Count of bulk indexing requests rejected',
	"The count of times omelasticsearch received a response that had a\n" .
	"status indicating Elasticsearch was unable to process the record at\n" .
	"this time - status 429.");
$pmda->add_metric(pmda_pmid(0,21), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.response.other',
	'Count of unexpected HTTP status codes encountered',
	"The count of times omelasticsearch received a response not recognized\n" .
	"as one of the expected responses, typically some other 4xx or 5xx http\n" .
	"status.");
$pmda->add_metric(pmda_pmid(0,22), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.elasticsearch.rebinds',
	'Count of reconnections made to Elasticsearch',
	"If using 'rebindinterval' this will be the count of times\n" .
	"omelasticsearch has reconnected to Elasticsearch");

$pmda->add_metric(pmda_pmid(0,23), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,1,0,0,PM_TIME_USEC,PM_COUNT_ONE), 'rsyslog.resources.utime',
	'Total time rsyslog spent in user mode (microseconds)','');
$pmda->add_metric(pmda_pmid(0,24), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,1,0,0,PM_TIME_USEC,PM_COUNT_ONE), 'rsyslog.resources.stime',
	'Total time rsyslog spent in system mode (microseconds)','');
$pmda->add_metric(pmda_pmid(0,25), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.maxrss',
	'Maximum resident set size used by rsyslog (kilobytes)','');
$pmda->add_metric(pmda_pmid(0,26), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.minflt',
	'Page reclaims (soft page faults)','');
$pmda->add_metric(pmda_pmid(0,27), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.majflt',
	'Page faults (hard page faults)','');
$pmda->add_metric(pmda_pmid(0,28), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.inblock',
	'Block input operations','');
$pmda->add_metric(pmda_pmid(0,29), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.oublock',
	'Block output operations','');
$pmda->add_metric(pmda_pmid(0,30), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.nvcsw',
	'Voluntary context switches','');
$pmda->add_metric(pmda_pmid(0,31), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.nivcsw',
	'Involuntary context switches','');
$pmda->add_metric(pmda_pmid(0,32), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.resources.openfiles',
	'Number of files rsyslog has open','');

$pmda->add_metric(pmda_pmid(0,33), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.ptcp.ioworkq.enqueued',
	'Current # of TCP log entries queued to the io-work-q','');
$pmda->add_metric(pmda_pmid(0,34), PM_TYPE_U64, PM_INDOM_NULL, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,PM_COUNT_ONE), 'rsyslog.ptcp.ioworkq.maxqsize',
	'Maximum size reached for the io-work-q','');

$pmda->add_metric(pmda_pmid(1,0), PM_TYPE_U64, $queue_indom, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,0), 'rsyslog.queues.size',
	'Current queue depth for each rsyslog queue',
	"As messages arrive they are enqueued to the main message queue\n" .
	"(for example) -this counter is incremented for each such message.");
$pmda->add_metric(pmda_pmid(1,1), PM_TYPE_U64, $queue_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.queues.enqueued',
	'Cumulative count of nessages enqueued to individual queues',
	"As messages arrive they are added to the main message processing\n" .
	"queue, either individually or in batches in the case of messages\n" .
	"arriving on the network.");
$pmda->add_metric(pmda_pmid(1,2), PM_TYPE_U64, $queue_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.queues.full',
	'Cumulative count of message arrivals with a full queue',
	"When messages are enqueued, a check is first made to ensure the\n" .
	"queue is not full.  If it is, this counter is incremented.  The\n" .
	"full-queue-handling logic will wait for a configurable time for\n" .
	"the queue congestion to ease, failing which the message will be\n" .
	"discarded.  Worth keeping an eye on this metric, as it indicates\n" .
	"rsyslog is not able to process messages quickly enough given the\n" .
	"current arrival rate.");
$pmda->add_metric(pmda_pmid(1,3), PM_TYPE_U64, $queue_indom, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,0), 'rsyslog.queues.maxsize',
	'Maximum depth reached by an individual queue',
	"When messages arrive (for example) they are enqueued to the main\n" .
	"message queue - if the queue length on arrival is now greater than\n" .
	"ever before observed, we set this value to the current queue size");
$pmda->add_metric(pmda_pmid(1,4), PM_TYPE_U64, $queue_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.queues.discarded.full',
	'Number of messages discarded because the queue was full', '');
$pmda->add_metric(pmda_pmid(1,5), PM_TYPE_U64, $queue_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.queues.discarded.nf',
	'Number of messages discarded because the queue was nearly full',
	"When messages arrive and the queue is nearly full (over the\n" .
	"configured threshold), messages of lower-than-configured priority\n" .
	"are discarded to save space for higher severity ones.");

$pmda->add_indom($queue_indom, \@queue_insts,
	'Instance domain exporting each rsyslog queue', '');

$pmda->add_metric(pmda_pmid(2,0), PM_TYPE_U64, $unrec_origin_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.impstats.origins.unrecog',
	'Cumulative count for an unrecognized origin', '');

$pmda->add_indom($unrec_origin_indom, \@unrec_origin_insts,
	'Cumulative counts for unrecognized impstats origins', '');

$pmda->add_metric(pmda_pmid(3,0), PM_TYPE_U64, $unmat_origin_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.impstats.origins.unmatched',
	'Cumulative count for an unmatched origin entries', '');

$pmda->add_indom($unmat_origin_indom, \@unmat_origin_insts,
	'Cumulative counts for unmatched impstats origins', '');

$pmda->add_metric(pmda_pmid(4,0), PM_TYPE_U64, $action_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.action.processed',
	'Count of messages processed',
	"The count of messages processed. Note that this includes both\n" .
	"success and failures.");
$pmda->add_metric(pmda_pmid(4,1), PM_TYPE_U64, $action_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.action.failed',
	'Count of messages failed during processing','');
$pmda->add_metric(pmda_pmid(4,2), PM_TYPE_U64, $action_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.action.suspended',
	'Count of times the action suspended itself','');
$pmda->add_metric(pmda_pmid(4,3), PM_TYPE_U64, $action_indom, PM_SEM_INSTANT,
	pmda_units(0,0,1,0,0,0), 'rsyslog.action.suspended_duration',
	'Total number of seconds action was suspended','');
$pmda->add_metric(pmda_pmid(4,4), PM_TYPE_U64, $action_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.action.resumed',
	'Count of times the action resumed itself','');

$pmda->add_indom($action_indom, \@action_insts,
	'Instance domain exporting each rsyslog action', '');

$pmda->add_metric(pmda_pmid(5,0), PM_TYPE_U64, $udp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.udp.submitted',
	'Count of messages submitted for processing since startup', '');
$pmda->add_metric(pmda_pmid(5,1), PM_TYPE_U64, $udp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.udp.disallowed',
	'Count of messages discarded due to disallowed sender', '');

$pmda->add_indom($udp_indom, \@udp_insts,
	'Instance domain exporting each rsyslog udp metric', '');

$pmda->add_metric(pmda_pmid(6,0), PM_TYPE_U64, $udpt_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.udp.thread.recvmmsg',
	'Count of recvmmsg() OS calls done', '');
$pmda->add_metric(pmda_pmid(6,1), PM_TYPE_U64, $udpt_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.udp.thread.recvmsg',
	'Count of recvmsg() OS calls done', '');
$pmda->add_metric(pmda_pmid(6,2), PM_TYPE_U64, $udpt_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.udp.thread.received',
	'Count of actual messages received', '');

$pmda->add_indom($udpt_indom, \@udpt_insts,
	'Instance domain exporting each rsyslog udp thread metric', '');

$pmda->add_metric(pmda_pmid(7,0), PM_TYPE_U64, $ptcp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.ptcp.submitted',
	'Count of TCP messages submitted for processing since startup', '');
$pmda->add_metric(pmda_pmid(7,1), PM_TYPE_U64, $ptcp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.ptcp.sessions.opened',
	'Count of TCP sessions opened', '');
$pmda->add_metric(pmda_pmid(7,2), PM_TYPE_U64, $ptcp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.ptcp.sessions.openfailed',
	'Count of TCP session failures', '');
$pmda->add_metric(pmda_pmid(7,3), PM_TYPE_U64, $ptcp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.ptcp.sessions.closed',
	'Count of TCP sessions closed', '');
$pmda->add_metric(pmda_pmid(7,4), PM_TYPE_U64, $ptcp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.ptcp.bytes.received',
	'Count of bytes received via TCP', '');
$pmda->add_metric(pmda_pmid(7,5), PM_TYPE_U64, $ptcp_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.ptcp.bytes.decompressed',
	'Count of bytes decompressed for TCP', '');

$pmda->add_indom($ptcp_indom, \@ptcp_insts,
	'Instance domain exporting each rsyslog ptcp metric', '');

$pmda->add_metric(pmda_pmid(8,0), PM_TYPE_U64, $fwd_indom, PM_SEM_COUNTER,
	pmda_units(0,0,1,0,0,0), 'rsyslog.fwd.bytes',
	'Count of bytes sent through forwarder', '');

$pmda->add_indom($fwd_indom, \@fwd_insts,
	'Instance domain exporting each rsyslog fwd metric', '');

$pmda->add_tail($statsfile, \&rsyslog_parser, 0);
$pmda->set_fetch_callback(\&rsyslog_fetch_callback);
$pmda->set_user('pcp');
$pmda->run;

Youez - 2016 - github.com/yon3zu
LinuXploit