[syslog-ng] [PATCH (3.4) 4/5] affile: Treat /dev/kmsg on linux specially

[Gergely Nagy]

On Linux, use a dgram reader for /dev/kmsg, because it works almost
exactly like a dgram source anyway, and a dgram reader is more
efficient than the indented-multiline one.

Also, change the system() source to not enforce indentedn-multiline on
/dev/kmsg anymore, since with the change to affile, there's no need
to.

Signed-off-by: Gergely Nagy <algernon at balabit.hu>
---
 modules/affile/affile.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/modules/affile/affile.c b/modules/affile/affile.c
index d756070..265a3d5 100644
--- a/modules/affile/affile.c
+++ b/modules/affile/affile.c
@@ -28,6 +28,7 @@
 #include "gprocess.h"
 #include "stats.h"
 #include "mainloop.h"
+#include "logproto-dgram-server.h"
 #include "logproto-record-server.h"
 #include "logproto-text-server.h"
 #include "logproto-indented-multiline-server.h"
@@ -55,6 +56,16 @@ affile_is_linux_proc_kmsg(const gchar *filename)
 }
 
 static inline gboolean
+affile_is_linux_dev_kmsg(const gchar *filename)
+{
+#ifdef __linux__
+  if (strcmp(filename, "/dev/kmsg") == 0)
+    return TRUE;
+#endif
+  return FALSE;
+}
+
+static inline gboolean
 affile_is_device_node(const gchar *filename)
 {
   struct stat st;
@@ -211,6 +222,8 @@ affile_sd_construct_proto(AFFileSourceDriver *self, gint fd)
     return log_proto_padded_record_server_new(transport, proto_options, self->pad_size);
   else if (affile_is_linux_proc_kmsg(self->filename->str))
     return log_proto_linux_proc_kmsg_reader_new(transport, proto_options);
+  else if (affile_is_linux_dev_kmsg(self->filename->str))
+    return log_proto_dgram_server_new(transport, proto_options);
   else if (self->reader_options.flags & LR_INDENTED_ML)
     return log_proto_indented_multiline_server_new(transport, proto_options);
   else
-- 
1.7.10.4