path: root/plugins/imfile/imfile.c

/* imfile.c
 *
 * This is the input module for reading text file data. A text file is a
 * non-binary file who's lines are delemited by the \n character.
 *
 * Work originally begun on 2008-02-01 by Rainer Gerhards
 *
 * Copyright 2008-2019 Adiscon GmbH.
 *
 * This file is part of rsyslog.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *       -or-
 *       see COPYING.ASL20 in the source distribution
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "config.h"
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <sys/types.h>
#include <unistd.h>
#include <time.h>
#include <glob.h>
#include <poll.h>
#include <json.h>
#include <fnmatch.h>
#ifdef HAVE_SYS_INOTIFY_H
#include <sys/inotify.h>
#include <linux/types.h>
#endif
#ifdef HAVE_SYS_STAT_H
#	include <sys/stat.h>
#endif
#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE)
#include <port.h>
#include <sys/port.h>
#endif
#include "rsyslog.h"		/* error codes etc... */
#include "dirty.h"
#include "cfsysline.h"		/* access to config file objects */
#include "module-template.h"	/* generic module interface code - very important, read it! */
#include "srUtils.h"		/* some utility functions */
#include "msg.h"
#include "stream.h"
#include "errmsg.h"
#include "glbl.h"
#include "unicode-helper.h"
#include "prop.h"
#include "stringbuf.h"
#include "ruleset.h"
#include "ratelimit.h"
#include "srUtils.h"
#include "parserif.h"
#include "datetime.h"

#include <regex.h>

/* some platforms do not have large file support :( */
#ifndef O_LARGEFILE
#  define O_LARGEFILE 0
#endif
#ifndef HAVE_LSEEK64
#  define lseek64(fd, offset, whence) lseek(fd, offset, whence)
#endif

MODULE_TYPE_INPUT
MODULE_TYPE_NOKEEP
MODULE_CNFNAME("imfile")

/* defines */
#define FILE_ID_HASH_SIZE 20	/* max size of a file_id hash */
#define FILE_ID_SIZE	512	/* how many bytes are used for file-id? */
#define FILE_DELETE_DELAY 5	/* how many seconds to wait before finally deleting a gone file */

/* Module static data */
DEF_IMOD_STATIC_DATA	/* must be present, starts static data */
DEFobjCurrIf(glbl)
DEFobjCurrIf(strm)
DEFobjCurrIf(prop)
DEFobjCurrIf(ruleset)
DEFobjCurrIf(datetime)

extern int rs_siphash(const uint8_t *in, const size_t inlen, const uint8_t *k,
	uint8_t *out, const size_t outlen); /* see siphash.c */

static int bLegacyCnfModGlobalsPermitted;/* are legacy module-global config parameters permitted? */

#define NUM_MULTISUB 1024 /* default max number of submits */
#define DFLT_PollInterval 10
#define INIT_WDMAP_TAB_SIZE 1 /* default wdMap table size - is extended as needed, use 2^x value */
#define ADD_METADATA_UNSPECIFIED -1

/* If set to 1, fileTableDisplay will be compiled and used for debugging */
#define ULTRA_DEBUG 0

/* Setting GLOB_BRACE to ZERO which disables support for GLOB_BRACE if not available on current platform */
#ifndef GLOB_BRACE
	#define GLOB_BRACE 0
#endif

typedef struct per_minute_rate_limit_s per_minute_rate_limit_t;

struct per_minute_rate_limit_s {
	uint64_t maxBytesPerMinute;
	uint32_t maxLinesPerMinute;
	uint64_t bytesThisMinute; /* bytes sent so far this minute */
	uint32_t linesThisMinute; /* lines sent to far this minute */
	time_t rateLimitingMinute; /* minute we are currently rate limiting for */
};

static struct configSettings_s {
	uchar *pszFileName;
	uchar *pszFileTag;
	uchar *pszStateFile;
	uchar *pszBindRuleset;
	int iPollInterval;
	int iPersistStateInterval;	/* how often if state file to be persisted? (default 0->never) */
	int bPersistStateAfterSubmission;/* persist state file after messages have been submitted */
	int iFacility; /* local0 */
	int iSeverity;  /* notice, as of rfc 3164 */
	int readMode;  /* mode to use for ReadMultiLine call */
	int64 maxLinesAtOnce;	/* how many lines to process in a row? */
	uint64_t maxBytesPerMinute; /* maximum bytes per minute to send before rate limiting */
	uint64_t maxLinesPerMinute; /* maximum lines per minute to send before rate limiting */
	uint32_t trimLineOverBytes;  /* 0: never trim line, positive number: trim line if over bytes */
} cs;

struct instanceConf_s {
	uchar *pszFileName;
	uchar *pszFileName_forOldStateFile; /* we unfortunately needs this to read old state files */
	uchar *pszDirName;
	uchar *pszFileBaseName;
	uchar *pszTag;
	size_t lenTag;
	uchar *pszStateFile;
	uchar *pszBindRuleset;
	int nMultiSub;
	per_minute_rate_limit_t perMinuteRateLimits;
	int iPersistStateInterval;
	int bPersistStateAfterSubmission;
	int iFacility;
	int iSeverity;
	int readTimeout;
	unsigned delay_perMsg;
	sbool bRMStateOnDel;
	uint8_t readMode;
	uchar *startRegex;
	uchar *endRegex;
	regex_t start_preg;	/* compiled version of startRegex */
	regex_t end_preg;	/* compiled version of endRegex */
	sbool discardTruncatedMsg;
	sbool msgDiscardingError;
	sbool escapeLF;
	sbool reopenOnTruncate;
	sbool addCeeTag;
	sbool addMetadata;
	sbool freshStartTail;
	sbool fileNotFoundError;
	int maxLinesAtOnce;
	uint32_t trimLineOverBytes;
	uint32_t ignoreOlderThan;
	int msgFlag;
	uchar *escapeLFString;
	ruleset_t *pBindRuleset;	/* ruleset to bind listener to (use system default if unspecified) */
	struct instanceConf_s *next;
};


/* file system objects */
typedef struct fs_edge_s fs_edge_t;
typedef struct fs_node_s fs_node_t;
typedef struct act_obj_s act_obj_t;
struct act_obj_s {
	act_obj_t *prev;
	act_obj_t *next;
	fs_edge_t *edge;	/* edge which this object belongs to */
	char *name;		/* full path name of active object */
	char *basename;		/* only basename */ //TODO: remove when refactoring rename support
	char *source_name;	/* if this object is target of a symlink, source_name is its name (else NULL) */
	//char *statefile;	/* base name of state file (for move operations) */
	int wd;
#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE)
	struct fileinfo *pfinf;
	sbool bPortAssociated;
	int is_deleted;	/* debugging: entry deleted? */
#endif
	time_t timeoutBase; /* what time to calculate the timeout against? */
	/* file dynamic data */
	char file_id[FILE_ID_HASH_SIZE]; /* file id for this entry, once we could obtain it */
	char file_id_prev[FILE_ID_HASH_SIZE]; /* previous file id for this entry, set if changed */
	int in_move;	/* workaround for inotify move: if set, state file must not be deleted */
	ino_t ino;	/* current inode nbr */
	int fd;		/* fd to file in order to obtain file_id (needs to be preserved across move) */
	strm_t *pStrm;	/* its stream (NULL if not assigned) */
	int nRecords; /**< How many records did we process before persisting the stream? */
	ratelimit_t *ratelimiter;
	multi_submit_t multiSub;
	int is_symlink;
	time_t time_to_delete;	/* Helper variable to DELAY the actual file delete in act_obj_unlink */
};
struct fs_edge_s {
	fs_node_t *parent;	/* node pointing to this edge */
	fs_node_t *node;	/* node this edge points to */
	fs_edge_t *next;
	uchar *name;
	uchar *path;
	act_obj_t *active;
	int is_file;
	int ninst;		/* nbr of instances in instarr */
	instanceConf_t **instarr;
};
struct fs_node_s {
	fs_edge_t *edges;	/* NULL in leaf nodes */
	fs_node_t *root;	/* node one level up (NULL for file system root) */
};


/* forward definitions */
static rsRetVal persistStrmState(act_obj_t *);
static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal);
static rsRetVal ATTR_NONNULL(1) pollFile(act_obj_t *act);
static int ATTR_NONNULL() getBasename(uchar *const __restrict__ basen, uchar *const __restrict__ path);
static void ATTR_NONNULL() act_obj_unlink(act_obj_t *act);
static uchar * ATTR_NONNULL(1, 2) getStateFileName(const act_obj_t *, uchar *, const size_t);
static int ATTR_NONNULL() getFullStateFileName(const uchar *const, const char *const,
	uchar *const pszout, const size_t ilenout);


#define OPMODE_POLLING 0
#define OPMODE_INOTIFY 1
#define OPMODE_FEN 2

/* config variables */
struct modConfData_s {
	rsconf_t *pConf;	/* our overall config object */
	int iPollInterval;	/* number of seconds to sleep when there was no file activity */
	int readTimeout;
	int timeoutGranularity;		/* value in ms */
	instanceConf_t *root, *tail;
	fs_node_t *conf_tree;
	uint8_t opMode;
	sbool configSetViaV2Method;
	uchar *stateFileDirectory;
	sbool sortFiles;
	sbool normalizePath;	/* normalize file system pathes (all start with root dir) */
	sbool haveReadTimeouts;	/* use special processing if read timeouts exist */
	sbool bHadFileData;	/* actually a global variable:
				   1 - last call to pollFile() had data
				   0 - last call to pollFile() had NO data
				   Must be manually reset to 0 if desired. Helper for
				   polling mode.
				 */
};
static modConfData_t *loadModConf = NULL;/* modConf ptr to use for the current load process */
static modConfData_t *runModConf = NULL;/* modConf ptr to use for run process */
static modConfData_t *currModConf = NULL;/* modConf ptr to CURRENT mod conf (run or load) */


#ifdef HAVE_INOTIFY_INIT
/* We need to map watch descriptors to our actual objects. Unfortunately, the
 * inotify API does not provide us with any cookie, so a simple O(1) algorithm
 * cannot be done (what a shame...). We assume that maintaining the array is much
 * less often done than looking it up, so we keep the array sorted by watch descriptor
 * and do a binary search on the wd we get back. This is at least O(log n), which
 * is not too bad for the anticipated use case.
 */
struct wd_map_s {
	int wd;		/* ascending sort key */
	act_obj_t *act; /* point to related active object */
};
typedef struct wd_map_s wd_map_t;
static wd_map_t *wdmap = NULL;
static int nWdmap;
static int allocMaxWdmap;
static int ino_fd;	/* fd for inotify calls */
#endif /* #if HAVE_INOTIFY_INIT -------------------------------------------------- */

#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE)
struct fileinfo {
	struct file_obj fobj;
	int events;
	int port;
};

static int glport; /* Static port handle for FEN api*/
#endif /* #if OS_SOLARIS -------------------------------------------------- */

static prop_t *pInputName = NULL;
/* there is only one global inputName for all messages generated by this input */

/* module-global parameters */
static struct cnfparamdescr modpdescr[] = {
	{ "pollinginterval", eCmdHdlrPositiveInt, 0 },
	{ "readtimeout", eCmdHdlrNonNegInt, 0 },
	{ "timeoutgranularity", eCmdHdlrPositiveInt, 0 },
	{ "sortfiles", eCmdHdlrBinary, 0 },
	{ "statefile.directory", eCmdHdlrString, 0 },
	{ "normalizepath", eCmdHdlrBinary, 0 },
	{ "mode", eCmdHdlrGetWord, 0 }
};
static struct cnfparamblk modpblk =
	{ CNFPARAMBLK_VERSION,
	  sizeof(modpdescr)/sizeof(struct cnfparamdescr),
	  modpdescr
	};

/* input instance parameters */
static struct cnfparamdescr inppdescr[] = {
	{ "file", eCmdHdlrString, CNFPARAM_REQUIRED },
	{ "tag", eCmdHdlrString, CNFPARAM_REQUIRED },
	{ "severity", eCmdHdlrSeverity, 0 },
	{ "facility", eCmdHdlrFacility, 0 },
	{ "ruleset", eCmdHdlrString, 0 },
	{ "readmode", eCmdHdlrInt, 0 },
	{ "startmsg.regex", eCmdHdlrString, 0 },
	{ "endmsg.regex", eCmdHdlrString, 0 },
	{ "discardtruncatedmsg", eCmdHdlrBinary, 0 },
	{ "msgdiscardingerror", eCmdHdlrBinary, 0 },
	{ "escapelf", eCmdHdlrBinary, 0 },
	{ "escapelf.replacement", eCmdHdlrString, 0 },
	{ "reopenontruncate", eCmdHdlrBinary, 0 },
	{ "maxlinesatonce", eCmdHdlrInt, 0 },
	{ "trimlineoverbytes", eCmdHdlrInt, 0 },
	{ "maxsubmitatonce", eCmdHdlrInt, 0 },
	{ "removestateondelete", eCmdHdlrBinary, 0 },
	{ "persiststateinterval", eCmdHdlrInt, 0 },
	{ "persiststateaftersubmission", eCmdHdlrBinary, 0 },
	{ "deletestateonfiledelete", eCmdHdlrBinary, 0 },
	{ "delay.message", eCmdHdlrNonNegInt, 0 },
	{ "addmetadata", eCmdHdlrBinary, 0 },
	{ "addceetag", eCmdHdlrBinary, 0 },
	{ "statefile", eCmdHdlrString, CNFPARAM_DEPRECATED },
	{ "readtimeout", eCmdHdlrNonNegInt, 0 },
	{ "freshstarttail", eCmdHdlrBinary, 0},
	{ "filenotfounderror", eCmdHdlrBinary, 0},
	{ "needparse", eCmdHdlrBinary, 0},
	{ "ignoreolderthan", eCmdHdlrInt, 0},
	{ "maxbytesperminute", eCmdHdlrInt, 0},
	{ "maxlinesperminute", eCmdHdlrInt, 0}
};
static struct cnfparamblk inppblk =
	{ CNFPARAMBLK_VERSION,
	  sizeof(inppdescr)/sizeof(struct cnfparamdescr),
	  inppdescr
	};

#include "im-helper.h" /* must be included AFTER the type definitions! */


/* Support for "old cruft" state files will potentially become optional in the
 * future (hopefully). To prepare so, we use conditional compilation with a
 * fixed-true condition ;-) -- rgerhards, 2018-03-28
 * reason: https://github.com/rsyslog/rsyslog/issues/2231#issuecomment-376862280
 */
#define ENABLE_V1_STATE_FILE_FORMAT_SUPPORT 1
#ifdef ENABLE_V1_STATE_FILE_FORMAT_SUPPORT
static uchar * ATTR_NONNULL(1, 2)
OLD_getStateFileName(const instanceConf_t *const inst,
	 uchar *const __restrict__ buf,
	 const size_t lenbuf)
{
	DBGPRINTF("OLD_getStateFileName trying '%s'\n", inst->pszFileName_forOldStateFile);
	snprintf((char*)buf, lenbuf - 1, "imfile-state:%s", inst->pszFileName_forOldStateFile);
	buf[lenbuf-1] = '\0'; /* be on the safe side... */
	uchar *p = buf;
	for( ; *p ; ++p) {
		if(*p == '/')
			*p = '-';
	}
	return buf;
}


static const uchar *
getStateFileDir(void)
{
	const uchar *wrkdir;
	assert(currModConf != NULL);
	if(currModConf->stateFileDirectory == NULL) {
		wrkdir = glblGetWorkDirRaw(currModConf->pConf);
	} else {
		wrkdir = currModConf->stateFileDirectory;
	}
	return(wrkdir);
}


/* try to open an old-style state file for given file. If the state file does not
 * exist or cannot be read, an error is returned.
 */
static rsRetVal ATTR_NONNULL(1)
OLD_openFileWithStateFile(act_obj_t *const act)
{
	DEFiRet;
	strm_t *psSF = NULL;
	uchar pszSFNam[MAXFNAME];
	size_t lenSFNam;
	struct stat stat_buf;
	uchar statefile[MAXFNAME];
	const instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?

	uchar *const statefn = OLD_getStateFileName(inst, statefile, sizeof(statefile));
	DBGPRINTF("OLD_openFileWithStateFile: trying to open state for '%s', state file '%s'\n",
		  act->name, statefn);

	/* Get full path and file name */
	lenSFNam = getFullStateFileName(statefn, "", pszSFNam, sizeof(pszSFNam));

	/* check if the file exists */
	if(stat((char*) pszSFNam, &stat_buf) == -1) {
		if(errno == ENOENT) {
			DBGPRINTF("OLD_openFileWithStateFile: NO state file (%s) exists for '%s'\n",
				pszSFNam, act->name);
			ABORT_FINALIZE(RS_RET_FILE_NOT_FOUND);
		} else {
			char errStr[1024];
			rs_strerror_r(errno, errStr, sizeof(errStr));
			DBGPRINTF("OLD_openFileWithStateFile: error trying to access state "
				"file for '%s':%s\n", act->name, errStr);
			ABORT_FINALIZE(RS_RET_IO_ERROR);
		}
	}

	/* If we reach this point, we have a state file */

	DBGPRINTF("old state file found - instantiating from it\n");
	CHKiRet(strm.Construct(&psSF));
	CHKiRet(strm.SettOperationsMode(psSF, STREAMMODE_READ));
	CHKiRet(strm.SetsType(psSF, STREAMTYPE_FILE_SINGLE));
	CHKiRet(strm.SetFName(psSF, pszSFNam, lenSFNam));
	CHKiRet(strm.SetFileNotFoundError(psSF, inst->fileNotFoundError));
	CHKiRet(strm.ConstructFinalize(psSF));

	/* read back in the object */
	CHKiRet(obj.Deserialize(&act->pStrm, (uchar*) "strm", psSF, NULL, act));
	free(act->pStrm->pszFName);
	CHKmalloc(act->pStrm->pszFName = ustrdup(act->name));

	strm.CheckFileChange(act->pStrm);
	CHKiRet(strm.SeekCurrOffs(act->pStrm));

	/* we now persist the new state file and delete the old one, so we will
	 * never have to deal with the old one. */
	persistStrmState(act);
	unlink((char*)pszSFNam);

finalize_it:
	if(psSF != NULL)
		strm.Destruct(&psSF);
	RETiRet;
}
#endif /* #ifdef ENABLE_V1_STATE_FILE_FORMAT_SUPPORT */



#if 0 // Code we can potentially use for new functionality // TODO: use or remove
//TODO add a kind of portable asprintf:
static const char * ATTR_NONNULL()
gen_full_name(const char *const dirname, const char *const name)
{
	const size_t len_full_name = strlen(dirname) + 1 + strlen(name) + 1;
	char *const full_name = malloc(len_full_name);
	if(full_name == NULL)
		return NULL;

	snprintf(full_name, len_full_name, "%s/%s", dirname, name);
	return full_name;
}
#endif


#ifdef HAVE_INOTIFY_INIT
#if ULTRA_DEBUG == 1
static void
dbg_wdmapPrint(const char *msg)
{
	int i;
	DBGPRINTF("%s\n", msg);
	for(i = 0 ; i < nWdmap ; ++i)
		DBGPRINTF("wdmap[%d]: wd: %d, act %p, name: %s\n",
			i, wdmap[i].wd, wdmap[i].act, wdmap[i].act->name);
}
#endif

static rsRetVal
wdmapInit(void)
{
	DEFiRet;
	free(wdmap);
	CHKmalloc(wdmap = malloc(sizeof(wd_map_t) * INIT_WDMAP_TAB_SIZE));
	allocMaxWdmap = INIT_WDMAP_TAB_SIZE;
	nWdmap = 0;
finalize_it:
	RETiRet;
}


/* note: we search backwards, as inotify tends to return increasing wd's */
static rsRetVal
wdmapAdd(int wd, act_obj_t *const act)
{
	wd_map_t *newmap;
	int newmapsize;
	int i;
	DEFiRet;

	for(i = nWdmap-1 ; i >= 0 && wdmap[i].wd > wd ; --i)
		; 	/* just scan */
	if(i >= 0 && wdmap[i].wd == wd) {
		LogError(0, RS_RET_INTERNAL_ERROR, "imfile: wd %d already in wdmap!", wd);
		ABORT_FINALIZE(RS_RET_FILE_ALREADY_IN_TABLE);
	}
	++i;
	/* i now points to the entry that is to be moved upwards (or end of map) */
	if(nWdmap == allocMaxWdmap) {
		newmapsize = 2 * allocMaxWdmap;
		CHKmalloc(newmap = realloc(wdmap, sizeof(wd_map_t) * newmapsize));
		// TODO: handle the error more intelligently? At all possible? -- 2013-10-15
		wdmap = newmap;
		allocMaxWdmap = newmapsize;
	}
	if(i < nWdmap) {
		/* we need to shift to make room for new entry */
		memmove(wdmap + i + 1, wdmap + i, sizeof(wd_map_t) * (nWdmap - i));
	}
	wdmap[i].wd = wd;
	wdmap[i].act = act;
	++nWdmap;
	DBGPRINTF("add wdmap[%d]: wd %d, act obj %p, path %s\n", i, wd, act, act->name);

finalize_it:
	RETiRet;
}

/* return wd or -1 on error */
static int
in_setupWatch(act_obj_t *const act, const int is_file)
{
	int wd = -1;
	if(runModConf->opMode != OPMODE_INOTIFY)
		goto done;

	wd = inotify_add_watch(ino_fd, act->name,
		(is_file) ? IN_MODIFY|IN_DONT_FOLLOW : IN_CREATE|IN_DELETE|IN_MOVED_FROM|IN_MOVED_TO);
	if(wd < 0) {
		if (errno == EACCES) { /* There is high probability of selinux denial on top-level paths */
			DBGPRINTF("imfile: permission denied when adding watch for '%s'\n", act->name);
		} else {
			LogError(errno, RS_RET_IO_ERROR, "imfile: cannot watch object '%s'", act->name);
		}
		goto done;
	}
	wdmapAdd(wd, act);
	DBGPRINTF("in_setupWatch: watch %d added for %s(object %p)\n", wd, act->name, act);
done:	return wd;
}

/* compare function for bsearch() */
static int
wdmap_cmp(const void *k, const void *a)
{
	int key = *((int*) k);
	wd_map_t *etry = (wd_map_t*) a;
	if(key < etry->wd)
		return -1;
	else if(key > etry->wd)
		return 1;
	else
		return 0;
}
/* looks up a wdmap entry and returns it's index if found
 * or -1 if not found.
 */
static wd_map_t *
wdmapLookup(int wd)
{
	return bsearch(&wd, wdmap, nWdmap, sizeof(wd_map_t), wdmap_cmp);
}


static rsRetVal
wdmapDel(const int wd)
{
	int i;
	DEFiRet;

	for(i = 0 ; i < nWdmap && wdmap[i].wd < wd ; ++i)
		; 	/* just scan */
	if(i == nWdmap ||  wdmap[i].wd != wd) {
		DBGPRINTF("wd %d shall be deleted but not in wdmap!\n", wd);
		FINALIZE;
	}

	if(i < nWdmap-1) {
		/* we need to shift to delete it (see comment at wdmap definition) */
		memmove(wdmap + i, wdmap + i + 1, sizeof(wd_map_t) * (nWdmap - i - 1));
	}
	--nWdmap;
	DBGPRINTF("wd %d deleted, was idx %d\n", wd, i);

finalize_it:
	RETiRet;
}

#endif // #ifdef HAVE_INOTIFY_INIT

#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE)
static void ATTR_NONNULL()
fen_setupWatch(act_obj_t *const act)
{
	DBGPRINTF("fen_setupWatch: enter, opMode %d\n", runModConf->opMode);
	if(runModConf->opMode != OPMODE_FEN)
		goto done;

	DBGPRINTF("fen_setupWatch: %s\n", act->name);
	if(act->pfinf == NULL) {
		act->pfinf = malloc(sizeof(struct fileinfo));
		if (act->pfinf == NULL) {
			LogError(errno, RS_RET_OUT_OF_MEMORY, "imfile: fen_setupWatch alloc memory "
				"for fileinfo failed ");
			goto done;
		}
		if ((act->pfinf->fobj.fo_name = strdup(act->name)) == NULL) {
			LogError(errno, RS_RET_OUT_OF_MEMORY, "imfile: fen_setupWatch alloc memory "
				"for strdup failed ");
			free(act->pfinf);
			act->pfinf = NULL;
			goto done;
		}
		act->pfinf->events = FILE_MODIFIED;
		act->pfinf->port = glport;
		act->bPortAssociated = 0;
	}

	DBGPRINTF("fen_setupWatch: bPortAssociated %d\n", act->bPortAssociated);
	if(act->bPortAssociated) {
		goto done;
	}

	struct stat fileInfo;
	const int r = stat(act->name, &fileInfo);
	if(r == -1) { /* object gone away? */
		DBGPRINTF("fen_setupWatch: file gone away, no watch: '%s'\n", act->name);
		goto done;
	}

	/* note: FEN watch must be re-registered each time - this is what we do now */
	act->pfinf->fobj.fo_atime = fileInfo.st_atim;
	act->pfinf->fobj.fo_mtime = fileInfo.st_mtim;
	act->pfinf->fobj.fo_ctime = fileInfo.st_ctim;
	if(port_associate(glport, PORT_SOURCE_FILE, (uintptr_t)&(act->pfinf->fobj),
				act->pfinf->events, (void *)act) == -1) {
		LogError(errno, RS_RET_SYS_ERR, "fen_setupWatch: Failed to associate port for file "
			": %s\n", act->pfinf->fobj.fo_name);
		goto done;
	} else {
		/* Port successfull listening now*/
		DBGPRINTF("fen_setupWatch: associated port for file %s\n", act->name);
		act->bPortAssociated = 1;
	}

	DBGPRINTF("in_setupWatch: fen association added for %s\n", act->name);
done:	return;
}
#else
static void ATTR_NONNULL()
fen_setupWatch(act_obj_t *const act __attribute__((unused)))
{
	DBGPRINTF("fen_setupWatch: DUMMY CALLED - not on Solaris?\n");
}
#endif /* FEN */

static void
fs_node_print(const fs_node_t *const node, const int level)
{
	fs_edge_t *chld;
	act_obj_t *act;
	dbgprintf("node print[%2.2d]: %p edges:\n", level, node);

	for(chld = node->edges ; chld != NULL ; chld = chld->next) {
		dbgprintf("node print[%2.2d]:     child %p '%s' isFile %d, path: '%s'\n",
			level, chld->node, chld->name, chld->is_file, chld->path);
		for(int i = 0 ; i < chld->ninst ; ++i) {
			dbgprintf("\tinst: %p\n", chld->instarr[i]);
		}
		for(act = chld->active ; act != NULL ; act = act->next) {
			dbgprintf("\tact : %p\n", act);
			dbgprintf("\tact : %p: name '%s', wd: %d\n",
				act, act->name, act->wd);
		}
	}
	for(chld = node->edges ; chld != NULL ; chld = chld->next) {
		fs_node_print(chld->node, level+1);
	}
}

static sbool
isIgnoreOlderFile(const instanceConf_t *const inst, const char *const name)
{
	if (inst->ignoreOlderThan)
	{
		struct stat stat_buf;
		time_t tt;
		/* skip old files */
		datetime.GetTime(&tt);
		if (stat((char *)name, &stat_buf) == 0 && difftime(tt, stat_buf.st_mtime) > inst->ignoreOlderThan) {
			return 1;
		}
	}
	return 0;
}

/* add a new file system object if it not yet exists, ignore call
 * if it already does.
 */
static rsRetVal ATTR_NONNULL(1,2)
act_obj_add(fs_edge_t *const edge, const char *const name, const int is_file,
	const ino_t ino, const int is_symlink, const char *const source)
{
	act_obj_t *act = NULL;
	char basename[MAXFNAME];
	DEFiRet;
	int fd = -1;

	DBGPRINTF("act_obj_add: edge %p, name '%s' (source '%s')\n", edge, name, source? source : "---");

	if (isIgnoreOlderFile(edge->instarr[0], name)) {
		ABORT_FINALIZE(RS_RET_ERR);
	}

	for(act = edge->active ; act != NULL ; act = act->next) {
		if(!strcmp(act->name, name)) {
			if (!source || !act->source_name || !strcmp(act->source_name, source)) {
				DBGPRINTF("active object '%s' already exists in '%s' - no need to add\n",
					name, edge->path);
				FINALIZE;
			}
		}
	}
	DBGPRINTF("need to add new active object '%s' in '%s' - checking if accessible\n", name, edge->path);
	fd = open(name, O_RDONLY | O_CLOEXEC);
	if(fd < 0) {
		if (is_file) {
			LogError(errno, RS_RET_ERR, "imfile: error accessing file '%s'", name);
		} else { /* reporting only in debug for dirs as higher lvl paths are likely blocked by selinux */
			DBGPRINTF("imfile: error accessing directory '%s'", name);
		}
		ABORT_FINALIZE(RS_RET_NO_FILE_ACCESS);
	}
	DBGPRINTF("add new active object '%s' in '%s'\n", name, edge->path);
	CHKmalloc(act = calloc(sizeof(act_obj_t), 1));
	CHKmalloc(act->name = strdup(name));
	if (-1 == getBasename((uchar*)basename, (uchar*)name)) {
		CHKmalloc(act->basename = strdup(name)); /* assume basename is same as name */
	} else {
		CHKmalloc(act->basename = strdup(basename));
	}
	act->edge = edge;
	act->ino = ino;
	act->fd = fd;
	act->file_id[0] = '\0';
	act->file_id_prev[0] = '\0';
	act->is_symlink = is_symlink;
	act->ratelimiter = NULL;
	act->time_to_delete = 0;
	if (source) { /* we are target of symlink */
		CHKmalloc(act->source_name = strdup(source));
	} else {
		act->source_name = NULL;
	}
	#ifdef HAVE_INOTIFY_INIT
	act->wd = in_setupWatch(act, is_file);
	#endif
	fen_setupWatch(act);
	if(is_file && !is_symlink) {
		const instanceConf_t *const inst = edge->instarr[0];// TODO: same file, multiple instances?
		CHKiRet(ratelimitNew(&act->ratelimiter, "imfile", name));
		CHKmalloc(act->multiSub.ppMsgs = malloc(inst->nMultiSub * sizeof(smsg_t *)));
		act->multiSub.maxElem = inst->nMultiSub;
		act->multiSub.nElem = 0;
		pollFile(act);
	}

	/* all well, add to active list */
	if(edge->active != NULL) {
		edge->active->prev = act;
	}
	act->next = edge->active;
	edge->active = act;
finalize_it:
	if(iRet != RS_RET_OK) {
		if(act != NULL) {
			if (act->ratelimiter != NULL)
				ratelimitDestruct(act->ratelimiter);
			free(act->name);
			free(act);
		}
		if(fd != -1) {
			close(fd);
		}
	}
	RETiRet;
}


/* this walks an edges active list and detects and acts on any changes
 * seen there. It does NOT detect newly appeared files, as they are not
 * inside the active list!
 */
static void
detect_updates(fs_edge_t *const edge)
{
	act_obj_t *act;
	struct stat fileInfo;
	int restart = 0;

	for(act = edge->active ; act != NULL ; act = act->next) {
		DBGPRINTF("detect_updates checking active obj '%s'\n", act->name);
		// lstat() has the disadvantage, that we get "deleted" when the name has changed
		// but inode is still the same (like with logrotate)
		int r = lstat(act->name, &fileInfo);
		if(r == -1) { /* object gone away? */
			/* now let's see if the file itself already exist (e.g. rotated away) */
			/* NOTE: this will NOT stall the file. The reason is that when a new file
			 * with the same name is detected, we will not run into this code.
			 TODO: check the full implications, there are for sure some!
			       e.g. file has been closed, so we will never have old inode (but
			            why was it closed then? --> check)
			 */
			r = fstat(act->ino, &fileInfo);
			if(r == -1) {
				time_t ttNow;
				time(&ttNow);
				if (act->time_to_delete == 0) {
					act->time_to_delete = ttNow;
				}
				/* First time we run into this code, we need to give imfile a little time to process
				*  the old file in case a process is still writing into it until the FILE_DELETE_DELAY
				*  is reached OR the inode has changed (see elseif below). In most cases, the
				*  delay will never be reached and the file will be closed when the inode has changed.
				*  Directories are deleted without delay.
				*/
				sbool is_file = act->edge->is_file;
				if (!is_file || act->time_to_delete + FILE_DELETE_DELAY < ttNow) {
				DBGPRINTF("detect_updates obj gone away, unlinking: "
					"'%s', ttDelete: %lds, ttNow:%ld isFile: %d\n",
					act->name, ttNow - (act->time_to_delete + FILE_DELETE_DELAY), ttNow, is_file);
					act_obj_unlink(act);
					restart = 1;
				} else {
				DBGPRINTF("detect_updates obj gone away, keep '%s' open: %ld/%ld/%lds!\n",
					act->name, act->time_to_delete, ttNow, ttNow - act->time_to_delete);
					pollFile(act);
				}
			}
			break;
		} else if(fileInfo.st_ino != act->ino) {
			DBGPRINTF("file '%s' inode changed from %llu to %llu, unlinking from "
				"internal lists\n", act->name, (long long unsigned) act->ino,
				(long long unsigned) fileInfo.st_ino);
			act_obj_unlink(act);
			restart = 1;
			break;
		}
	}

	if (restart) {
		detect_updates(edge);
	}
}


/* check if active files need to be processed. This is only needed in
 * polling mode.
 */
static void ATTR_NONNULL()
poll_active_files(fs_edge_t *const edge)
{
	if(   runModConf->opMode != OPMODE_POLLING
	   || !edge->is_file
	   || glbl.GetGlobalInputTermState() != 0) {
		return;
	}

	act_obj_t *act;
	for(act = edge->active ; act != NULL ; act = act->next) {
		fen_setupWatch(act);
		DBGPRINTF("poll_active_files: polling '%s'\n", act->name);
		pollFile(act);
	}
}

static rsRetVal ATTR_NONNULL()
process_symlink(fs_edge_t *const chld, const char *symlink)
{
	DEFiRet;
	char *target;
	CHKmalloc(target = realpath(symlink, NULL));
	struct stat fileInfo;
	if(lstat(target, &fileInfo) != 0) {
		LogError(errno, RS_RET_ERR,	"imfile: process_symlink: cannot stat file '%s' - ignored", target);
		FINALIZE;
	}
	const int is_file = (S_ISREG(fileInfo.st_mode));
	DBGPRINTF("process_symlink:  found '%s', File: %d (config file: %d), symlink: %d\n",
		target, is_file, chld->is_file, 0);
	if (act_obj_add(chld, target, is_file, fileInfo.st_ino, 0, symlink) == RS_RET_OK) {
		/* need to watch parent target as well for proper rotation support */
		uint idx = ustrlen(chld->active->name) - ustrlen(chld->active->basename);
		if (idx) { /* basename is different from name */
			char parent[MAXFNAME];
			idx--; /* move past trailing slash */
			memcpy(parent, chld->active->name, idx);
			parent[idx] = '\0';
			if(lstat(parent, &fileInfo) != 0) {
				LogError(errno, RS_RET_ERR,
					"imfile: process_symlink: cannot stat directory '%s' - ignored", parent);
				FINALIZE;
			}
			if (chld->parent->root->edges) {
				DBGPRINTF("process_symlink: adding parent '%s' of target '%s'\n", parent, target);
				act_obj_add(chld->parent->root->edges, parent, 0, fileInfo.st_ino, 0, NULL);
			}
		}
	}

finalize_it:
	free(target);
	RETiRet;
}

static void ATTR_NONNULL()
poll_tree(fs_edge_t *const chld)
{
	struct stat fileInfo;
	glob_t files;
	int need_globfree = 0;
	int issymlink;
	DBGPRINTF("poll_tree: chld %p, name '%s', path: %s\n", chld, chld->name, chld->path);
	detect_updates(chld);
	const int ret = glob((char*)chld->path, runModConf->sortFiles|GLOB_BRACE, NULL, &files);
	need_globfree = 1;
	DBGPRINTF("poll_tree: glob returned %d\n", ret);
	if(ret == 0) {
		DBGPRINTF("poll_tree: processing %d files\n", (int) files.gl_pathc);
		for(unsigned i = 0 ; i < files.gl_pathc ; i++) {
			if(glbl.GetGlobalInputTermState() != 0) {
				goto done;
			}
			char *const file = files.gl_pathv[i];
			if(lstat(file, &fileInfo) != 0) {
				LogError(errno, RS_RET_ERR,
					"imfile: poll_tree cannot stat file '%s' - ignored", file);
				continue;
			}

			if (S_ISLNK(fileInfo.st_mode)) {
				rsRetVal slink_ret = process_symlink(chld, file);
				if (slink_ret != RS_RET_OK) {
					continue;
				}
				issymlink = 1;
			} else {
				issymlink = 0;
			}
			const int is_file = (S_ISREG(fileInfo.st_mode) || issymlink);
			DBGPRINTF("poll_tree:  found '%s', File: %d (config file: %d), symlink: %d\n",
				file, is_file, chld->is_file, issymlink);
			if(!is_file && S_ISREG(fileInfo.st_mode)) {
				LogMsg(0, RS_RET_ERR, LOG_WARNING,
					"imfile: '%s' is neither a regular file, symlink, nor a "
					"directory - ignored", file);
				continue;
			}
			if(!issymlink && (chld->is_file != is_file)) {
				LogMsg(0, RS_RET_ERR, LOG_WARNING,
					"imfile: '%s' is %s but %s expected - ignored",
					file, (is_file) ? "FILE" : "DIRECTORY",
					(chld->is_file) ? "FILE" : "DIRECTORY");
				continue;
			}
			act_obj_add(chld, file, is_file, fileInfo.st_ino, issymlink, NULL);
		}
	}

	poll_active_files(chld);

done:
	if(need_globfree) {
		globfree(&files);
	}
	return;
}

#ifdef HAVE_INOTIFY_INIT // TODO: shouldn't we use that in polling as well?
static void ATTR_NONNULL()
poll_timeouts(fs_edge_t *const edge)
{
	if(edge->is_file) {
		act_obj_t *act;
		for(act = edge->active ; act != NULL ; act = act->next) {
			if(act->pStrm && strmReadMultiLine_isTimedOut(act->pStrm)) {
				DBGPRINTF("timeout occurred on %s\n", act->name);
				pollFile(act);
			}
		}
	}
}
#endif


/* destruct a single act_obj object */
static void
act_obj_destroy(act_obj_t *const act, const int is_deleted)
{
	uchar *statefn;
	uchar statefile[MAXFNAME];
	uchar toDel[MAXFNAME];

	if(act == NULL)
		return;

	DBGPRINTF("act_obj_destroy: act %p '%s' (source '%s'), wd %d, pStrm %p, is_deleted %d, in_move %d\n",
		act, act->name, act->source_name? act->source_name : "---", act->wd, act->pStrm, is_deleted,
		act->in_move);
	if(act->is_symlink && is_deleted) {
		act_obj_t *target_act;
		for(target_act = act->edge->active ; target_act != NULL ; target_act = target_act->next) {
			if(target_act->source_name && !strcmp(target_act->source_name, act->name)) {
				DBGPRINTF("act_obj_destroy: detect_updates for parent of target %s of %s symlink\n",
						target_act->name, act->name);
				detect_updates(target_act->edge->parent->root->edges);
				break;
			}
		}
	}
	if(act->pStrm != NULL) {
		const instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?
		pollFile(act); /* get any left-over data */
		if(inst->bRMStateOnDel) {
			statefn = getStateFileName(act, statefile, sizeof(statefile));
			getFullStateFileName(statefn, act->file_id, toDel, sizeof(toDel)); // TODO: check!
			statefn = toDel;
		}
		persistStrmState(act);
		strm.Destruct(&act->pStrm);
		/* we delete state file after destruct in case strm obj initiated a write */
		if(is_deleted && !act->in_move && inst->bRMStateOnDel) {
			DBGPRINTF("act_obj_destroy: deleting state file %s\n", statefn);
			unlink((char*)statefn);
		}
	}
	if(act->ratelimiter != NULL) {
		ratelimitDestruct(act->ratelimiter);
	}
	#ifdef HAVE_INOTIFY_INIT
	if(act->wd != -1) {
		inotify_rm_watch(ino_fd, act->wd);
		wdmapDel(act->wd);
	}
	#endif
	if(act->fd >= 0) {
		close(act->fd);
	}
	#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE)
	if(act->pfinf != NULL) {
		free(act->pfinf->fobj.fo_name);
		free(act->pfinf);
	}
	#endif
	free(act->basename);
	free(act->source_name);
	free(act->multiSub.ppMsgs);
	#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE)
		act->is_deleted = 1;
	#else
		free(act->name);
		free(act);
	#endif
}


/* destroy complete act list starting at given node */
static void
act_obj_destroy_all(act_obj_t *act)
{
	if(act == NULL)
		return;

	DBGPRINTF("act_obj_destroy_all: act %p '%s', wd %d, pStrm %p\n", act, act->name, act->wd, act->pStrm);
	while(act != NULL) {
		act_obj_t *const toDel = act;
		act = act->next;
		act_obj_destroy(toDel, 0);
	}
}

#if 0
/* debug: find if ptr is still present in list */
static void
chk_active(const act_obj_t *act, const act_obj_t *const deleted)
{
	while(act != NULL) {
		DBGPRINTF("chk_active %p vs %p\n", act, deleted);
		if(act->prev == deleted)
			DBGPRINTF("chk_active %p prev points to %p\n", act, deleted);
		if(act->next == deleted)
			DBGPRINTF("chk_active %p next points to %p\n", act, deleted);
		act = act->next;
		DBGPRINTF("chk_active next %p\n", act);
	}
}
#endif

/* unlink act object from linked list and then
 * destruct it.
 */
static void ATTR_NONNULL()
act_obj_unlink(act_obj_t *act)
{
	DBGPRINTF("act_obj_unlink %p: %s, pStrm %p, ttDelete: %ld\n",
		act, act->name, act->pStrm, act->time_to_delete);
	if(act->prev == NULL) {
		act->edge->active = act->next;
	} else {
		act->prev->next = act->next;
	}
	if(act->next != NULL) {
		act->next->prev = act->prev;
	}
	act_obj_destroy(act, 1);
	act = NULL;
}

static void
fs_node_destroy(fs_node_t *const node)
{
	fs_edge_t *edge;
	DBGPRINTF("node destroy: %p edges:\n", node);

	for(edge = node->edges ; edge != NULL ; ) {
		detect_updates(edge);
		fs_node_destroy(edge->node);
		fs_edge_t *const toDel = edge;
		edge = edge->next;
		act_obj_destroy_all(toDel->active);
		free(toDel->name);
		free(toDel->path);
		free(toDel->instarr);
		free(toDel);
	}
	free(node);
}

static void ATTR_NONNULL(1, 2)
fs_node_walk(fs_node_t *const node,
	void (*f_usr)(fs_edge_t*const))
{
	DBGPRINTF("node walk: %p edges:\n", node);

	fs_edge_t *edge;
	for(edge = node->edges ; edge != NULL ; edge = edge->next) {
		DBGPRINTF("node walk: child %p '%s'\n", edge->node, edge->name);
		f_usr(edge);
		fs_node_walk(edge->node, f_usr);
	}
}



/* add a file system object to config tree (or update existing node with new monitor)
 */
static rsRetVal
fs_node_add(fs_node_t *const node,
	fs_node_t *const source,
	const uchar *const toFind,
	const size_t pathIdx,
	instanceConf_t *const inst)
{
	DEFiRet;
	fs_edge_t *newchld = NULL;
	int i;

	DBGPRINTF("fs_node_add(%p, '%s') enter, idx %zd\n",
		node, toFind+pathIdx, pathIdx);
	assert(toFind[0] != '\0');
	for(i = pathIdx ; (toFind[i] != '\0') && (toFind[i] != '/') ; ++i)
		/*JUST SKIP*/;
	const int isFile = (toFind[i] == '\0') ? 1 : 0;
	uchar ourPath[PATH_MAX];
	if(i == 0) {
		ourPath[0] = '/';
		ourPath[1] = '\0';
	} else {
		memcpy(ourPath, toFind, i);
		ourPath[i] = '\0';
	}
	const size_t nextPathIdx = i+1;
	const size_t len = i - pathIdx;
	uchar name[PATH_MAX];
	memcpy(name, toFind+pathIdx, len);
	name[len] = '\0';
	DBGPRINTF("fs_node_add: name '%s'\n", name);
	node->root = source;

	fs_edge_t *chld;
	for(chld = node->edges ; chld != NULL ; chld = chld->next) {
		if(!ustrcmp(chld->name, name)) {
			DBGPRINTF("fs_node_add(%p, '%s') found '%s'\n", chld->node, toFind, name);
			/* add new instance */
			instanceConf_t **instarr_new = realloc(chld->instarr,
							sizeof(instanceConf_t*) * (chld->ninst+1));
			CHKmalloc(instarr_new);
			chld->instarr = instarr_new;
			chld->ninst++;
			chld->instarr[chld->ninst-1] = inst;
			/* recurse */
			if(!isFile) {
				CHKiRet(fs_node_add(chld->node, node, toFind, nextPathIdx, inst));
			}
			FINALIZE;
		}
	}

	/* could not find node --> add it */
	DBGPRINTF("fs_node_add(%p, '%s') did not find '%s' - adding it\n",
		node, toFind, name);
	CHKmalloc(newchld = calloc(sizeof(fs_edge_t), 1));
	CHKmalloc(newchld->name = ustrdup(name));
	CHKmalloc(newchld->node = calloc(sizeof(fs_node_t), 1));
	CHKmalloc(newchld->path = ustrdup(ourPath));
	CHKmalloc(newchld->instarr = calloc(sizeof(instanceConf_t*), 1));
	newchld->instarr[0] = inst;
	newchld->is_file = isFile;
	newchld->ninst = 1;
	newchld->parent = node;

	DBGPRINTF("fs_node_add(%p, '%s') returns %p\n", node, toFind, newchld->node);

	if(!isFile) {
		CHKiRet(fs_node_add(newchld->node, node, toFind, nextPathIdx, inst));
	}

	/* link to list */
	newchld->next = node->edges;
	node->edges = newchld;
finalize_it:
	if(iRet != RS_RET_OK) {
		if(newchld != NULL) {
		free(newchld->name);
		free(newchld->node);
		free(newchld->path);
		free(newchld->instarr);
		free(newchld);
		}
	}
	RETiRet;
}


/* Helper function to combine statefile and state file directory
 * This function is guranteed to work only on config data and DOES NOT
 * open or otherwise modify disk file state.
 */
static int ATTR_NONNULL()
getFullStateFileName(const uchar *const pszstatefile,
	const char *const file_id,
	uchar *const pszout,
	const size_t ilenout)
{
	int lenout;
	const uchar* pszstatedir;

	/* Get Raw Workdir, if it is NULL we need to propper handle it */
	pszstatedir = getStateFileDir();

	/* Construct file name */
	lenout = snprintf((char*)pszout, ilenout, "%s/%s%s%s",
		(char*) (pszstatedir == NULL ? "." : (char*) pszstatedir), (char*)pszstatefile,
		(*file_id == '\0') ? "" : ":", file_id);

	/* return out length */
	return lenout;
}


/* hash function for file-id
 * Takes a block of data and returns a string with the hash value.
 *
 * Currently one provided by Aaaron Wiebe based on perl's hashing algorithm
 * (so probably pretty generic). Not for excessively large strings!
 * TODO: re-think the hash function!
 */
#if defined(__clang__)
#pragma GCC diagnostic ignored "-Wunknown-attributes"
#endif
static void __attribute__((nonnull(1,3)))
#if defined(__clang__)
__attribute__((no_sanitize("unsigned-integer-overflow")))
#endif
get_file_id_hash(const char *data, size_t lendata,
	char *const hash_str, const size_t len_hash_str)
{
	assert(len_hash_str >= 17); /* we always generate 8-byte strings */

	size_t i;
	uint8_t out[8], k[16];
	for (i = 0; i < 16; ++i)
		k[i] = i;
	memset(out, 0, sizeof(out));
	rs_siphash((const uint8_t *)data, lendata, k, out, 8);

	for(i = 0 ; i < 8 ; ++i) {
		if(2 * i+1 >= len_hash_str)
			break;
		snprintf(hash_str+(2*i), 3, "%2.2x", out[i]);
	}
}


/* this returns the file-id for a given file
 */
static void ATTR_NONNULL(1)
getFileID(act_obj_t *const act)
{
	char tmp_id[FILE_ID_HASH_SIZE];
	strncpy(tmp_id, (const char*)act->file_id, FILE_ID_HASH_SIZE);
	act->file_id[0] = '\0';
	assert(act->fd >= 0); /* fd must have been opened at act_obj_t creation! */
	char filedata[FILE_ID_SIZE];
	lseek(act->fd, 0, SEEK_SET); /* Seek to beginning of file so we have correct id */
	const int r = read(act->fd, filedata, FILE_ID_SIZE);
	if(r == FILE_ID_SIZE) {
		get_file_id_hash(filedata, sizeof(filedata), act->file_id, sizeof(act->file_id));
	} else {
		DBGPRINTF("getFileID partial or error read, ret %d\n", r);
	}
	if (strncmp(tmp_id, act->file_id, FILE_ID_HASH_SIZE)) {/* save the old id for cleaning purposes */
		strncpy(act->file_id_prev, tmp_id, FILE_ID_HASH_SIZE);
	}
	DBGPRINTF("getFileID for '%s', file_id_hash '%s'\n", act->name, act->file_id);
}

/* this generates a state file name suitable for the given file. To avoid
 * malloc calls, it must be passed a buffer which should be MAXFNAME large.
 * Note: the buffer is not necessarily populated ... always ONLY use the
 * RETURN VALUE!
 * This function is guranteed to work only on config data and DOES NOT
 * open or otherwise modify disk file state.
 */
static uchar * ATTR_NONNULL(1, 2)
getStateFileName(const act_obj_t *const act,
	 	 uchar *const __restrict__ buf,
		 const size_t lenbuf)
{
	DBGPRINTF("getStateFileName for '%s'\n", act->name);
	snprintf((char*)buf, lenbuf - 1, "imfile-state:%lld", (long long) act->ino);
	DBGPRINTF("getStateFileName:  state file name now is %s\n", buf);
	return buf;
}

static rsRetVal
checkPerMinuteRateLimits(per_minute_rate_limit_t *per_minute_rate_limits,
			     const size_t msgLen)
{
	DEFiRet;
	time_t current_minute = time(NULL)/60;
	if(per_minute_rate_limits->maxBytesPerMinute) {
		if (per_minute_rate_limits->rateLimitingMinute == current_minute) {
			per_minute_rate_limits->bytesThisMinute += msgLen;
			/* if we would breach our rate limit then do not send the message. */
			if (per_minute_rate_limits->bytesThisMinute > per_minute_rate_limits->maxBytesPerMinute) {
				ABORT_FINALIZE(RS_RET_RATE_LIMITED);
			}
		} else {
			per_minute_rate_limits->rateLimitingMinute = current_minute;
			per_minute_rate_limits->bytesThisMinute = msgLen; /* Update count as message will be sent */
		}
	}
	if(per_minute_rate_limits->maxLinesPerMinute) {
		if (per_minute_rate_limits->rateLimitingMinute == current_minute) {
			per_minute_rate_limits->linesThisMinute++;
			/* if we would breach our rate limit then do not send the message. */
			if (per_minute_rate_limits->linesThisMinute > per_minute_rate_limits->maxLinesPerMinute) {
				ABORT_FINALIZE(RS_RET_RATE_LIMITED);
			}
		} else {
			per_minute_rate_limits->rateLimitingMinute = current_minute;
			per_minute_rate_limits->linesThisMinute = 1; /* Update count as message will be sent */
		}
	}
finalize_it:
	RETiRet;
}

/* enqueue the read file line as a message. The provided string is
 * not freed - this must be done by the caller.
 */
#define MAX_OFFSET_REPRESENTATION_NUM_BYTES 20
static rsRetVal ATTR_NONNULL(1,2)
enqLine(act_obj_t *const act,
	cstr_t *const __restrict__ cstrLine,
	const int64 strtOffs)
{
	DEFiRet;
	const instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?
	smsg_t *pMsg;
	uchar file_offset[MAX_OFFSET_REPRESENTATION_NUM_BYTES+1];
	const uchar *metadata_names[2] = {(uchar *)"filename",(uchar *)"fileoffset"} ;
	const uchar *metadata_values[2] ;
	const size_t msgLen = cstrLen(cstrLine);

	if(msgLen == 0) {
		/* we do not process empty lines */
		FINALIZE;
	}

	CHKiRet(msgConstruct(&pMsg));
	MsgSetFlowControlType(pMsg, eFLOWCTL_FULL_DELAY);
	MsgSetInputName(pMsg, pInputName);
	if(inst->addCeeTag) {
		/* Make sure we account for terminating null byte */
		size_t ceeMsgSize = msgLen + CONST_LEN_CEE_COOKIE + 1;
		char *ceeMsg;
		CHKmalloc(ceeMsg = malloc(ceeMsgSize));
		strcpy(ceeMsg, CONST_CEE_COOKIE);
		strcat(ceeMsg, (char*)rsCStrGetSzStrNoNULL(cstrLine));
		MsgSetRawMsg(pMsg, ceeMsg, ceeMsgSize);
		free(ceeMsg);
	} else {
		MsgSetRawMsg(pMsg, (char*)rsCStrGetSzStrNoNULL(cstrLine), msgLen);
	}
	MsgSetMSGoffs(pMsg, 0);	/* we do not have a header... */
	MsgSetHOSTNAME(pMsg, glbl.GetLocalHostName(), ustrlen(glbl.GetLocalHostName()));
	MsgSetTAG(pMsg, inst->pszTag, inst->lenTag);
	msgSetPRI(pMsg, inst->iFacility | inst->iSeverity);
	MsgSetRuleset(pMsg, inst->pBindRuleset);
	if(inst->addMetadata) {
		if (act->source_name) {
			metadata_values[0] = (const uchar*)act->source_name;
		} else {
			metadata_values[0] = (const uchar*)act->name;
		}
		snprintf((char *)file_offset, MAX_OFFSET_REPRESENTATION_NUM_BYTES+1, "%lld", strtOffs);
		metadata_values[1] = file_offset;
		msgAddMultiMetadata(pMsg, metadata_names, metadata_values, 2);
	}

	if(inst->perMinuteRateLimits.maxBytesPerMinute || inst->perMinuteRateLimits.maxLinesPerMinute) {
		CHKiRet(checkPerMinuteRateLimits((per_minute_rate_limit_t *)&inst->perMinuteRateLimits, msgLen));
	}

	if(inst->delay_perMsg) {
		srSleep(inst->delay_perMsg % 1000000, inst->delay_perMsg / 1000000);
	}

	pMsg->msgFlags = pMsg->msgFlags | inst->msgFlag;

	ratelimitAddMsg(act->ratelimiter, &act->multiSub, pMsg);
finalize_it:
	RETiRet;
}
/* try to open a file which has a state file. If the state file does not
 * exist or cannot be read, an error is returned.
 */
static rsRetVal ATTR_NONNULL(1)
openFileWithStateFile(act_obj_t *const act)
{
	DEFiRet;
	uchar pszSFNam[MAXFNAME];
	uchar statefile[MAXFNAME];
	int fd = -1;
	const instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?

	uchar *const statefn = getStateFileName(act, statefile, sizeof(statefile));
	getFileID(act);

	getFullStateFileName(statefn, act->file_id, pszSFNam, sizeof(pszSFNam));
	DBGPRINTF("trying to open state for '%s', state file '%s'\n", act->name, pszSFNam);

	/* check if the file exists */
	fd = open((char*)pszSFNam, O_CLOEXEC | O_NOCTTY | O_RDONLY, 0600);
	if(fd < 0) {
		if(errno == ENOENT) {
			if(act->file_id[0] != '\0') {
				DBGPRINTF("state file %s for %s does not exist - trying to see if "
					"inode-only file exists\n", pszSFNam, act->name);
				getFullStateFileName(statefn, "", pszSFNam, sizeof(pszSFNam));
				fd = open((char*)pszSFNam, O_CLOEXEC | O_NOCTTY | O_RDONLY, 0600);
				if(fd >= 0) {
					dbgprintf("found inode-only state file, will be renamed at next persist\n");
				}
			}
			if(fd < 0) {
				DBGPRINTF("state file %s for %s does not exist - trying to see if "
					"old-style file exists\n", pszSFNam, act->name);
				CHKiRet(OLD_openFileWithStateFile(act));
				FINALIZE;
			}
		} else {
			LogError(errno, RS_RET_IO_ERROR,
				"imfile error trying to access state file for '%s'",
			        act->name);
			ABORT_FINALIZE(RS_RET_IO_ERROR);
		}
	}

	DBGPRINTF("opened state file %s for %s\n", pszSFNam, act->name);
	CHKiRet(strm.Construct(&act->pStrm));

	struct json_object *jval;
	struct json_object *json = fjson_object_from_fd(fd);
	if(json == NULL) {
		LogError(0, RS_RET_ERR, "imfile: error reading state file for '%s'", act->name);
	}

	/* we access some data items a bit dirty, as we need to refactor the whole
	 * thing in any case - TODO
	 */
	/* Note: we ignore filname property - it is just an aid to the user. Most
	 * importantly it *is wrong* after a file move!
	 */
	fjson_object_object_get_ex(json, "prev_was_nl", &jval);
	act->pStrm->bPrevWasNL = fjson_object_get_int(jval);

	fjson_object_object_get_ex(json, "curr_offs", &jval);
	act->pStrm->iCurrOffs = fjson_object_get_int64(jval);

	fjson_object_object_get_ex(json, "strt_offs", &jval);
	act->pStrm->strtOffs = fjson_object_get_int64(jval);

	fjson_object_object_get_ex(json, "prev_line_segment", &jval);
	const uchar *const prev_line_segment = (const uchar*)fjson_object_get_string(jval);
	if(jval != NULL) {
		CHKiRet(rsCStrConstructFromszStr(&act->pStrm->prevLineSegment, prev_line_segment));
		cstrFinalize(act->pStrm->prevLineSegment);
		uchar *ret = rsCStrGetSzStrNoNULL(act->pStrm->prevLineSegment);
		DBGPRINTF("prev_line_segment present in state file 2, is: %s\n", ret);
	}

	fjson_object_object_get_ex(json, "prev_msg_segment", &jval);
	const uchar *const prev_msg_segment = (const uchar*)fjson_object_get_string(jval);
	if(jval != NULL) {
		CHKiRet(rsCStrConstructFromszStr(&act->pStrm->prevMsgSegment, prev_msg_segment));
		cstrFinalize(act->pStrm->prevMsgSegment);
		uchar *ret = rsCStrGetSzStrNoNULL(act->pStrm->prevMsgSegment);
		DBGPRINTF("prev_msg_segment present in state file 2, is: %s\n", ret);
	}
	fjson_object_put(json);

	CHKiRet(strm.SetFName(act->pStrm, (uchar*)act->name, strlen(act->name)));
	CHKiRet(strm.SettOperationsMode(act->pStrm, STREAMMODE_READ));
	CHKiRet(strm.SetsType(act->pStrm, STREAMTYPE_FILE_MONITOR));
	CHKiRet(strm.SetFileNotFoundError(act->pStrm, inst->fileNotFoundError));
	CHKiRet(strm.ConstructFinalize(act->pStrm));

	CHKiRet(strm.SeekCurrOffs(act->pStrm));

finalize_it:
	if(fd >= 0) {
		close(fd);
	}
	RETiRet;
}

/* try to open a file for which no state file exists. This function does NOT
 * check if a state file actually exists or not -- this must have been
 * checked before calling it.
 */
static rsRetVal
openFileWithoutStateFile(act_obj_t *const act)
{
	DEFiRet;
	const instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?

	DBGPRINTF("clean startup withOUT state file for '%s'\n", act->name);
	if(act->pStrm != NULL)
		strm.Destruct(&act->pStrm);
	CHKiRet(strm.Construct(&act->pStrm));
	CHKiRet(strm.SettOperationsMode(act->pStrm, STREAMMODE_READ));
	CHKiRet(strm.SetsType(act->pStrm, STREAMTYPE_FILE_MONITOR));
	CHKiRet(strm.SetFName(act->pStrm, (uchar*)act->name, strlen(act->name)));
	CHKiRet(strm.SetFileNotFoundError(act->pStrm, inst->fileNotFoundError));
	CHKiRet(strm.ConstructFinalize(act->pStrm));

	/* As a state file not exist, this is a fresh start. seek to file end
	 * when freshStartTail is on.
	 */
	if(inst->freshStartTail) {
		const int fd = open(act->name, O_RDONLY | O_CLOEXEC);
		if(fd >= 0) {
			act->pStrm->iCurrOffs = lseek64(fd, 0, SEEK_END);
			close(fd);
			if(act->pStrm->iCurrOffs < 0) {
				act->pStrm->iCurrOffs = 0;
				LogError(errno, RS_RET_ERR, "imfile: could not query current "
					"file size for %s - 'freshStartTail' option will "
					"be ignored, starting at begin of file", inst->pszFileName);
			}
			CHKiRet(strm.SeekCurrOffs(act->pStrm));
		}
	}

finalize_it:
	RETiRet;
}

/* try to open a file. This involves checking if there is a status file and,
 * if so, reading it in. Processing continues from the last known location.
 */
static rsRetVal
openFile(act_obj_t *const act)
{
	DEFiRet;
	const instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?

	CHKiRet_Hdlr(openFileWithStateFile(act)) {
		CHKiRet(openFileWithoutStateFile(act));
	}

	DBGPRINTF("breopenOnTruncate %d for '%s'\n", inst->reopenOnTruncate, act->name);
	CHKiRet(strm.SetbReopenOnTruncate(act->pStrm, inst->reopenOnTruncate));
	strmSetReadTimeout(act->pStrm, inst->readTimeout);

finalize_it:
	RETiRet;
}


/* The following is a cancel cleanup handler for strmReadLine(). It is necessary in case
 * strmReadLine() is cancelled while processing the stream. -- rgerhards, 2008-03-27
 */
static void pollFileCancelCleanup(void *pArg)
{
	cstr_t **ppCStr = (cstr_t**) pArg;
	if(*ppCStr != NULL)
		rsCStrDestruct(ppCStr);
}


/* pollFile needs to be split due to the unfortunate pthread_cancel_push() macros. */
static rsRetVal ATTR_NONNULL()
pollFileReal(act_obj_t *act, cstr_t **pCStr)
{
	int64 strtOffs;
	DEFiRet;
	int64_t startOffs = 0;
	int nProcessed = 0;
	regex_t *start_preg = NULL, *end_preg = NULL;

	DBGPRINTF("pollFileReal enter, act %p, pStrm %p, name '%s'\n", act, act->pStrm, act->name);
	DBGPRINTF("pollFileReal enter, edge %p\n", act->edge);
	DBGPRINTF("pollFileReal enter, edge->instarr %p\n", act->edge->instarr);

	instanceConf_t *const inst = act->edge->instarr[0];// TODO: same file, multiple instances?

	if(act->pStrm == NULL) {
		CHKiRet(openFile(act)); /* open file */
	}

	start_preg = (inst->startRegex == NULL) ? NULL : &inst->start_preg;
	end_preg = (inst->endRegex == NULL) ? NULL : &inst->end_preg;

	startOffs = act->pStrm->iCurrOffs;
	/* loop below will be exited when strmReadLine() returns EOF */
	while(glbl.GetGlobalInputTermState() == 0) {
		if(inst->maxLinesAtOnce != 0 && nProcessed >= inst->maxLinesAtOnce)
			break;
		if((start_preg == NULL) && (end_preg == NULL)) {
			CHKiRet(strm.ReadLine(act->pStrm, pCStr, inst->readMode, inst->escapeLF, inst->escapeLFString,
				inst->trimLineOverBytes, &strtOffs));
		} else {
			CHKiRet(strmReadMultiLine(act->pStrm, pCStr, start_preg, end_preg,
				inst->escapeLF, inst->escapeLFString, inst->discardTruncatedMsg,
				inst->msgDiscardingError, &strtOffs));
		}
		++nProcessed;
		if(startOffs < FILE_ID_SIZE && act->pStrm->iCurrOffs >= FILE_ID_SIZE) {
			dbgprintf("initiating state file write as sufficient data is now present; file=%s\n",
				act->name);
			persistStrmState(act);
			startOffs = act->pStrm->iCurrOffs; /* disable check */
		}
		runModConf->bHadFileData = 1; /* this is just a flag, so set it and forget it */
		CHKiRet(enqLine(act, *pCStr, strtOffs)); /* process line */
		rsCStrDestruct(pCStr); /* discard string (must be done by us!) */
		if(inst->iPersistStateInterval > 0 && ++act->nRecords >= inst->iPersistStateInterval) {
			persistStrmState(act);
			act->nRecords = 0;
		}
	}

finalize_it:
	multiSubmitFlush(&act->multiSub);
	if(inst->bPersistStateAfterSubmission) {
		persistStrmState(act);
	}

	if(*pCStr != NULL) {
		rsCStrDestruct(pCStr);
	}

	RETiRet;
}

/* poll a file, need to check file rollover etc. open file if not open */
static rsRetVal ATTR_NONNULL(1)
pollFile(act_obj_t *const act)
{
	cstr_t *pCStr = NULL;
	DEFiRet;
	if (act->is_symlink) {
		FINALIZE;    /* no reason to poll symlink file */
	}
	/* Note: we must do pthread_cleanup_push() immediately, because the POSIX macros
	 * otherwise do not work if I include the _cleanup_pop() inside an if... -- rgerhards, 2008-08-14
	 */
	pthread_cleanup_push(pollFileCancelCleanup, &pCStr);
	iRet = pollFileReal(act, &pCStr);
	pthread_cleanup_pop(0);
finalize_it: RETiRet;
}


/* create input instance, set default parameters, and
 * add it to the list of instances.
 */
static rsRetVal ATTR_NONNULL(1)
createInstance(instanceConf_t **const pinst)
{
	instanceConf_t *inst;
	DEFiRet;
	CHKmalloc(inst = malloc(sizeof(instanceConf_t)));
	inst->next = NULL;
	inst->pBindRuleset = NULL;

	inst->pszBindRuleset = NULL;
	inst->pszFileName = NULL;
	inst->pszTag = NULL;
	inst->pszStateFile = NULL;
	inst->nMultiSub = NUM_MULTISUB;
	inst->iSeverity = 5;
	inst->iFacility = 128;
	inst->maxLinesAtOnce = 0;
	inst->trimLineOverBytes = 0;
	inst->iPersistStateInterval = 0;
	inst->perMinuteRateLimits.maxBytesPerMinute = 0;
	inst->perMinuteRateLimits.maxLinesPerMinute = 0;
	inst->perMinuteRateLimits.rateLimitingMinute = 0;
	inst->perMinuteRateLimits.linesThisMinute = 0;
	inst->perMinuteRateLimits.bytesThisMinute = 0;
	inst->bPersistStateAfterSubmission = 0;
	inst->readMode = 0;
	inst->startRegex = NULL;
	inst->endRegex = NULL;
	inst->discardTruncatedMsg = 0;
	inst->msgDiscardingError = 1;
	inst->bRMStateOnDel = 1;
	inst->escapeLF = 1;
	inst->escapeLFString = NULL;
	inst->reopenOnTruncate = 0;
	inst->addMetadata = ADD_METADATA_UNSPECIFIED;
	inst->addCeeTag = 0;
	inst->freshStartTail = 0;
	inst->fileNotFoundError = 1;
	inst->readTimeout = loadModConf->readTimeout;
	inst->delay_perMsg = 0;
	inst->msgFlag = 0;
	inst->ignoreOlderThan = 0;

	/* node created, let's add to config */
	if(loadModConf->tail == NULL) {
		loadModConf->tail = loadModConf->root = inst;
	} else {
		loadModConf->tail->next = inst;
		loadModConf->tail = inst;
	}

	*pinst = inst;
finalize_it:
	RETiRet;
}


/* the basen(ame) buffer must be of size MAXFNAME
 * returns the index of the slash in front of basename
 */
static int ATTR_NONNULL()
getBasename(uchar *const __restrict__ basen, uchar *const __restrict__ path)
{
	int i;
	int found = 0;
	const int lenName = ustrlen(path);
	for(i = lenName ; i >= 0 ; --i) {
		if(path[i] == '/') {
			/* found basename component */
			found = 1;
			if(i == lenName)
				basen[0] = '\0';
			else {
				memcpy(basen, path+i+1, lenName-i);
			}
			break;
		}
	}
	if (found == 1)
		return i;
	else {
		return -1;
	}
}

/* this function checks instance parameters and does some required pre-processing
 */
static rsRetVal ATTR_NONNULL()
checkInstance(instanceConf_t *const inst)
{
	uchar curr_wd[MAXFNAME];
	DEFiRet;

	/* this is primarily for the clang static analyzer, but also
	 * guards against logic errors in the config handler.
	 */
	if(inst->pszFileName == NULL)
		ABORT_FINALIZE(RS_RET_INTERNAL_ERROR);

	CHKmalloc(inst->pszFileName_forOldStateFile = ustrdup(inst->pszFileName));
	if(loadModConf->normalizePath) {
		if(inst->pszFileName[0] == '.' && inst->pszFileName[1] == '/') {
			DBGPRINTF("imfile: removing heading './' from name '%s'\n", inst->pszFileName);
			memmove(inst->pszFileName, inst->pszFileName+2, ustrlen(inst->pszFileName) - 1);
		}

		if(inst->pszFileName[0] != '/') {
			if(getcwd((char*)curr_wd, MAXFNAME) == NULL || curr_wd[0] != '/') {
				LogError(errno, RS_RET_ERR, "imfile: error querying current working "
					"directory - can not continue with %s", inst->pszFileName);
				ABORT_FINALIZE(RS_RET_ERR);
			}
			const size_t len_curr_wd = ustrlen(curr_wd);
			if(len_curr_wd + ustrlen(inst->pszFileName) + 1 >= MAXFNAME) {
				LogError(0, RS_RET_ERR, "imfile: length of configured file and current "
					"working directory exceeds permitted size - ignoring %s",
					inst->pszFileName);
				ABORT_FINALIZE(RS_RET_ERR);
			}
			curr_wd[len_curr_wd] = '/';
			strcpy((char*)curr_wd+len_curr_wd+1, (char*)inst->pszFileName);
			free(inst->pszFileName);
			CHKmalloc(inst->pszFileName = ustrdup(curr_wd));
		}
	}
	dbgprintf("imfile: adding file monitor for '%s'\n", inst->pszFileName);

	if(inst->pszTag != NULL) {
		inst->lenTag = ustrlen(inst->pszTag);
	}
finalize_it:
	RETiRet;
}


/* add a new monitor */
static rsRetVal
addInstance(void __attribute__((unused)) *pVal, uchar *pNewVal)
{
	instanceConf_t *inst;
	DEFiRet;

	if(cs.pszFileName == NULL) {
		LogError(0, RS_RET_CONFIG_ERROR, "imfile error: no file name given, file monitor can "
					"not be created");
		ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
	}
	if(cs.pszFileTag == NULL) {
		LogError(0, RS_RET_CONFIG_ERROR, "imfile error: no tag value given, file monitor can "
					"not be created");
		ABORT_FINALIZE(RS_RET_CONFIG_ERROR);
	}

	CHKiRet(createInstance(&inst));
	if((cs.pszBindRuleset == NULL) || (cs.pszBindRuleset[0] == '\0')) {
		inst->pszBindRuleset = NULL;
	} else {
		CHKmalloc(inst->pszBindRuleset = ustrdup(cs.pszBindRuleset));
	}
	CHKmalloc(inst->pszFileName = ustrdup((char*) cs.pszFileName));
	CHKmalloc(inst->pszTag = ustrdup((char*) cs.pszFileTag));
	if(cs.pszStateFile == NULL) {
		inst->pszStateFile = NULL;
	} else {
		CHKmalloc(inst->pszStateFile = ustrdup(cs.pszStateFile));
	}
	inst->iSeverity = cs.iSeverity;
	inst->iFacility = cs.iFacility;
	if(cs.maxLinesAtOnce) {
		if(loadModConf->opMode == OPMODE_INOTIFY) {
			LogError(0, RS_RET_PARAM_NOT_PERMITTED,
				"parameter \"maxLinesAtOnce\" not "
				"permited in inotify mode - ignored");
		} else {
			inst->maxLinesAtOnce = cs.maxLinesAtOnce;
		}
	}
	inst->trimLineOverBytes = cs.trimLineOverBytes;
	inst->ignoreOlderThan = 0;
	inst->iPersistStateInterval = cs.iPersistStateInterval;
	inst->perMinuteRateLimits.maxBytesPerMinute = cs.maxBytesPerMinute;
	inst->perMinuteRateLimits.maxLinesPerMinute = cs.maxLinesPerMinute;
	inst->bPersistStateAfterSubmission = 0;
	inst->readMode = cs.readMode;
	inst->escapeLF = 0;
	inst->escapeLFString = NULL;
	inst->reopenOnTruncate = 0;
	inst->addMetadata = 0;
	inst->addCeeTag = 0;
	inst->bRMStateOnDel = 0;
	inst->readTimeout = loadModConf->readTimeout;
	inst->msgFlag = 0;

	CHKiRet(checkInstance(inst));

	/* reset legacy system */
	cs.iPersistStateInterval = 0;
	resetConfigVariables(NULL, NULL); /* values are both dummies */

finalize_it:
	free(pNewVal); /* we do not need it, but we must free it! */
	RETiRet;
}


BEGINnewInpInst
	struct cnfparamvals *pvals;
	instanceConf_t *inst;
	int i;
CODESTARTnewInpInst
	DBGPRINTF("newInpInst (imfile)\n");

	pvals = nvlstGetParams(lst, &inppblk, NULL);
	if(pvals == NULL) {
		ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS);
	}

	if(Debug) {
		DBGPRINTF("input param blk in imfile:\n");
		cnfparamsPrint(&inppblk, pvals);
	}

	CHKiRet(createInstance(&inst));

	for(i = 0 ; i < inppblk.nParams ; ++i) {
		if(!pvals[i].bUsed)
			continue;
		if(!strcmp(inppblk.descr[i].name, "file")) {
			inst->pszFileName = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "statefile")) {
			inst->pszStateFile = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "removestateondelete")) {
			inst->bRMStateOnDel = (uint8_t) pvals[i].val.d.n; // TODO: duplicate!
		} else if(!strcmp(inppblk.descr[i].name, "tag")) {
			inst->pszTag = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "ruleset")) {
			inst->pszBindRuleset = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "severity")) {
			inst->iSeverity = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "facility")) {
			inst->iFacility = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "readmode")) {
			inst->readMode = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "startmsg.regex")) {
			inst->startRegex = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "endmsg.regex")) {
			inst->endRegex = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "discardtruncatedmsg")) {
			inst->discardTruncatedMsg = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "msgdiscardingerror")) {
			inst->msgDiscardingError = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "deletestateonfiledelete")) {
			inst->bRMStateOnDel = (sbool) pvals[i].val.d.n; // TODO: duplicate!
		} else if(!strcmp(inppblk.descr[i].name, "addmetadata")) {
			inst->addMetadata = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "delay.message")) {
			inst->delay_perMsg = (unsigned) pvals[i].val.d.n;
		} else if (!strcmp(inppblk.descr[i].name, "addceetag")) {
			inst->addCeeTag = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "freshstarttail")) {
			inst->freshStartTail = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "filenotfounderror")) {
			inst->fileNotFoundError = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "escapelf")) {
			inst->escapeLF = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "escapelf.replacement")) {
			inst->escapeLFString = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(inppblk.descr[i].name, "reopenontruncate")) {
			inst->reopenOnTruncate = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "maxlinesatonce")) {
			if(   loadModConf->opMode == OPMODE_INOTIFY
			   && pvals[i].val.d.n > 0) {
				LogError(0, RS_RET_PARAM_NOT_PERMITTED,
					"parameter \"maxLinesAtOnce\" not "
					"permited in inotify mode - ignored");
			} else {
				inst->maxLinesAtOnce = pvals[i].val.d.n;
			}
		} else if(!strcmp(inppblk.descr[i].name, "trimlineoverbytes")) {
			inst->trimLineOverBytes = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "ignoreolderthan")) {
			inst->ignoreOlderThan = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "persiststateinterval")) {
			inst->iPersistStateInterval = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "maxbytesperminute")) {
			DBGPRINTF("imfile: enabling maxbytesperminute ratelimiting\n");
			inst->perMinuteRateLimits.maxBytesPerMinute = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "maxlinesperminute")) {
			DBGPRINTF("imfile: enabling maxlinesperminute ratelimiting\n");
			inst->perMinuteRateLimits.maxLinesPerMinute = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "persiststateaftersubmission")) {
			inst->bPersistStateAfterSubmission = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "maxsubmitatonce")) {
			inst->nMultiSub = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "readtimeout")) {
			inst->readTimeout = pvals[i].val.d.n;
		} else if(!strcmp(inppblk.descr[i].name, "needparse")) {
			inst->msgFlag = pvals[i].val.d.n ? NEEDS_PARSING : 0;
		} else {
			DBGPRINTF("program error, non-handled "
			  "param '%s'\n", inppblk.descr[i].name);
		}
	}
	i = (inst->readMode > 0) ? 1 : 0;
	i = (NULL != inst->startRegex) ? (i+1) : i;
	i = (NULL != inst->endRegex) ? (i+1) : i;
	if(i > 1) {
		LogError(0, RS_RET_PARAM_NOT_PERMITTED,
			"only one of readMode or startmsg.regex or endmsg.regex can be set "
			"at the same time");
			ABORT_FINALIZE(RS_RET_PARAM_NOT_PERMITTED);
	}

	if(inst->startRegex != NULL) {
		const int errcode = regcomp(&inst->start_preg, (char*)inst->startRegex, REG_EXTENDED);
		if(errcode != 0) {
			char errbuff[512];
			regerror(errcode, &inst->start_preg, errbuff, sizeof(errbuff));
			parser_errmsg("imfile: error in startmsg.regex expansion: %s", errbuff);
			ABORT_FINALIZE(RS_RET_ERR);
		}
	}
	if(inst->endRegex != NULL) {
		const int errcode = regcomp(&inst->end_preg, (char*)inst->endRegex, REG_EXTENDED);
		if(errcode != 0) {
			char errbuff[512];
			regerror(errcode, &inst->end_preg, errbuff, sizeof(errbuff));
			parser_errmsg("imfile: error in endmsg.regex expansion: %s", errbuff);
			ABORT_FINALIZE(RS_RET_ERR);
		}
	}
	if(inst->readTimeout != 0)
		loadModConf->haveReadTimeouts = 1;
	iRet = checkInstance(inst);
finalize_it:
CODE_STD_FINALIZERnewInpInst
	cnfparamvalsDestruct(pvals, &inppblk);
ENDnewInpInst

BEGINbeginCnfLoad
CODESTARTbeginCnfLoad
	loadModConf = pModConf;
	currModConf = pModConf;
	pModConf->pConf = pConf;
	/* init our settings */
	loadModConf->opMode = OPMODE_POLLING;
	loadModConf->iPollInterval = DFLT_PollInterval;
	loadModConf->configSetViaV2Method = 0;
	loadModConf->readTimeout = 0; /* default: no timeout */
	loadModConf->timeoutGranularity = 1000; /* default: 1 second */
	loadModConf->haveReadTimeouts = 0; /* default: no timeout */
	loadModConf->normalizePath = 1;
	loadModConf->sortFiles = GLOB_NOSORT;
	loadModConf->stateFileDirectory = NULL;
	loadModConf->conf_tree = calloc(sizeof(fs_node_t), 1);
	loadModConf->conf_tree->edges = NULL;
	bLegacyCnfModGlobalsPermitted = 1;
	/* init legacy config vars */
	cs.pszFileName = NULL;
	cs.pszFileTag = NULL;
	cs.pszStateFile = NULL;
	cs.iPollInterval = DFLT_PollInterval;
	cs.iPersistStateInterval = 0;
	cs.iFacility = 128;
	cs.iSeverity = 5;
	cs.readMode = 0;
	cs.maxLinesAtOnce = 10240;
	cs.trimLineOverBytes = 0;
ENDbeginCnfLoad


BEGINsetModCnf
	struct cnfparamvals *pvals = NULL;
	int i;
CODESTARTsetModCnf
	#if defined(HAVE_PORT_SOURCE_FILE)
		/* this means we are on Solaris, so inotify is not there */
		loadModConf->opMode = OPMODE_FEN;
	#elif defined(HAVE_INOTIFY_INIT)
		loadModConf->opMode = OPMODE_INOTIFY;
	#else
		loadModConf->opMode = OPMODE_POLLING;
	#endif
	pvals = nvlstGetParams(lst, &modpblk, NULL);
	if(pvals == NULL) {
		LogError(0, RS_RET_MISSING_CNFPARAMS, "imfile: error processing module "
				"config parameters [module(...)]");
		ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS);
	}

	if(Debug) {
		DBGPRINTF("module (global) param blk for imfile:\n");
		cnfparamsPrint(&modpblk, pvals);
	}

	for(i = 0 ; i < modpblk.nParams ; ++i) {
		if(!pvals[i].bUsed)
			continue;
		if(!strcmp(modpblk.descr[i].name, "pollinginterval")) {
			loadModConf->iPollInterval = (int) pvals[i].val.d.n;
		} else if(!strcmp(modpblk.descr[i].name, "readtimeout")) {
			loadModConf->readTimeout = (int) pvals[i].val.d.n;
		} else if(!strcmp(modpblk.descr[i].name, "timeoutgranularity")) {
			/* note: we need ms, thus "* 1000" */
			loadModConf->timeoutGranularity = (int) pvals[i].val.d.n * 1000;
		} else if(!strcmp(modpblk.descr[i].name, "sortfiles")) {
			loadModConf->sortFiles = ((sbool) pvals[i].val.d.n) ? 0 : GLOB_NOSORT;
		} else if(!strcmp(modpblk.descr[i].name, "statefile.directory")) {
			loadModConf->stateFileDirectory = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
		} else if(!strcmp(modpblk.descr[i].name, "normalizepath")) {
			loadModConf->normalizePath = (sbool) pvals[i].val.d.n;
		} else if(!strcmp(modpblk.descr[i].name, "mode")) {
			if(!es_strconstcmp(pvals[i].val.d.estr, "polling"))
				loadModConf->opMode = OPMODE_POLLING;
			else if(!es_strconstcmp(pvals[i].val.d.estr, "inotify")) {
#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE) /* use FEN on Solaris! */
				loadModConf->opMode = OPMODE_FEN;
				DBGPRINTF("inotify mode configured, but only FEN "
					"is available on OS SOLARIS. Switching to FEN "
					"Mode automatically\n");
#else
				#if defined(HAVE_INOTIFY_INIT)
					loadModConf->opMode = OPMODE_INOTIFY;
				#else
					loadModConf->opMode = OPMODE_POLLING;
				#endif
#endif
			} else if(!es_strconstcmp(pvals[i].val.d.estr, "fen"))
				loadModConf->opMode = OPMODE_FEN;
			else {
				char *cstr = es_str2cstr(pvals[i].val.d.estr, NULL);
				LogError(0, RS_RET_PARAM_ERROR, "imfile: unknown "
					"mode '%s'", cstr);
				free(cstr);
			}
		} else {
			DBGPRINTF("program error, non-handled "
			  "param '%s' in beginCnfLoad\n", modpblk.descr[i].name);
		}
	}

	/* remove all of our legacy handlers, as they can not used in addition
	 * the the new-style config method.
	 */
	bLegacyCnfModGlobalsPermitted = 0;
	loadModConf->configSetViaV2Method = 1;

finalize_it:
	if(pvals != NULL)
		cnfparamvalsDestruct(pvals, &modpblk);
ENDsetModCnf


BEGINendCnfLoad
CODESTARTendCnfLoad
	if(!loadModConf->configSetViaV2Method) {
		/* persist module-specific settings from legacy config system */
		loadModConf->iPollInterval = cs.iPollInterval;
	}
	DBGPRINTF("opmode is %d, polling interval is %d\n",
		  loadModConf->opMode,
		  loadModConf->iPollInterval);

	loadModConf = NULL; /* done loading */
	/* free legacy config vars */
	free(cs.pszFileName);
	free(cs.pszFileTag);
	free(cs.pszStateFile);
ENDendCnfLoad


BEGINcheckCnf
	instanceConf_t *inst;
CODESTARTcheckCnf
	if(getStateFileDir() == NULL) {
		/* this intentionally is an error message */
		LogError(0, RS_RET_NO_WRKDIR_SET,
			"imfile: no working or state file directory set, imfile will create "
			"state files in the current working directory (probably "
			"the root dir). Use global(workDirectory=\"/some/path\") "
			"to set the working directory");
	}
	for(inst = pModConf->root ; inst != NULL ; inst = inst->next) {
		std_checkRuleset(pModConf, inst);
	}
	if(pModConf->root == NULL) {
		LogError(0, RS_RET_NO_LISTNERS,
				"imfile: no files configured to be monitored - "
				"no input will be gathered");
		iRet = RS_RET_NO_LISTNERS;
	}
ENDcheckCnf


/* note: we do access files AFTER we have dropped privileges. This is
 * intentional, user must make sure the files have the right permissions.
 */
BEGINactivateCnf
	instanceConf_t *inst;
CODESTARTactivateCnf
	runModConf = pModConf;
	currModConf = pModConf;
	if(runModConf->root == NULL) {
		LogError(0, NO_ERRCODE, "imfile: no file monitors configured, "
				"input not activated.\n");
		ABORT_FINALIZE(RS_RET_NO_RUN);
	}

	for(inst = runModConf->root ; inst != NULL ; inst = inst->next) {
		// TODO: provide switch to turn off this warning?
		if(!containsGlobWildcard((char*)inst->pszFileName)) {
			if(access((char*)inst->pszFileName, R_OK) != 0) {
				LogError(errno, RS_RET_ERR,
					"imfile: on startup file '%s' does not exist "
					"but is configured in static file monitor - this "
					"may indicate a misconfiguration. If the file "
					"appears at a later time, it will automatically "
					"be processed. Reason", inst->pszFileName);
			}
		}
		fs_node_add(runModConf->conf_tree, NULL, inst->pszFileName, 0, inst);
	}

	if(Debug) {
		fs_node_print(runModConf->conf_tree, 0);
	}

finalize_it:
ENDactivateCnf


BEGINfreeCnf
	instanceConf_t *inst, *del;
CODESTARTfreeCnf
	fs_node_destroy(pModConf->conf_tree);
	for(inst = pModConf->root ; inst != NULL ; ) {
		free(inst->pszBindRuleset);
		free(inst->pszFileName);
		free(inst->pszTag);
		free(inst->pszStateFile);
		free(inst->pszFileName_forOldStateFile);
		if(inst->startRegex != NULL) {
			regfree(&inst->start_preg);
			free(inst->startRegex);
		}
		if(inst->endRegex != NULL) {
			regfree(&inst->end_preg);
			free(inst->endRegex);
		}
		del = inst;
		inst = inst->next;
		free(del);
	}
ENDfreeCnf


/* initial poll run, to be used for all modes. Depending on mode, it does some
 * further initializations (e.g. watches in inotify mode). Most importantly,
 * it processes already-existing files, which would not otherwise be picked
 * up in notifcation modes (inotfiy, FEN). Also, when freshStartTail is set,
 * this run assumes that all previous existing data exists and needs not
 * to be considered.
 * Note: there is a race on files created *during* the run, but that race is
 * inevitable (and thus freshStartTail is actually broken, but users still seem
 * to want it...).
 * rgerhards, 2018-05-17
 */
static void
do_initial_poll_run(void)
{
	fs_node_walk(runModConf->conf_tree, poll_tree);

	/* fresh start done, so disable freshStartTail for files that now will be created */
	for(instanceConf_t *inst = runModConf->root ; inst != NULL ; inst = inst->next) {
		inst->freshStartTail = 0;
	}
}


/* Monitor files in polling mode. */
static rsRetVal
doPolling(void)
{
	DEFiRet;
	do_initial_poll_run();
	while(glbl.GetGlobalInputTermState() == 0) {
		DBGPRINTF("doPolling: new poll run\n");
		do {
			runModConf->bHadFileData = 0;
			fs_node_walk(runModConf->conf_tree, poll_tree);
			DBGPRINTF("doPolling: end poll walk, hadData %d\n", runModConf->bHadFileData);
		} while(runModConf->bHadFileData); /* warning: do...while()! */

		/* Note: the additional 10ns wait is vitally important. It guards rsyslog
		 * against totally hogging the CPU if the users selects a polling interval
		 * of 0 seconds. It doesn't hurt any other valid scenario. So do not remove.
		 * rgerhards, 2008-02-14
		 */
		DBGPRINTF("doPolling: poll going to sleep\n");
		if(glbl.GetGlobalInputTermState() == 0)
			srSleep(runModConf->iPollInterval, 10);
	}

	RETiRet;
}

#if defined(HAVE_INOTIFY_INIT)

static void ATTR_NONNULL(1)
in_dbg_showEv(const struct inotify_event *ev)
{
	if(!Debug)
		return;
	if(ev->mask & IN_IGNORED) {
		dbgprintf("INOTIFY event: watch was REMOVED\n");
	}
	if(ev->mask & IN_MODIFY) {
		dbgprintf("INOTIFY event: watch was MODIFID\n");
	}
	if(ev->mask & IN_ACCESS) {
		dbgprintf("INOTIFY event: watch IN_ACCESS\n");
	}
	if(ev->mask & IN_ATTRIB) {
		dbgprintf("INOTIFY event: watch IN_ATTRIB\n");
	}
	if(ev->mask & IN_CLOSE_WRITE) {
		dbgprintf("INOTIFY event: watch IN_CLOSE_WRITE\n");
	}
	if(ev->mask & IN_CLOSE_NOWRITE) {
		dbgprintf("INOTIFY event: watch IN_CLOSE_NOWRITE\n");
	}
	if(ev->mask & IN_CREATE) {
		dbgprintf("INOTIFY event: file was CREATED: %s\n", ev->name);
	}
	if(ev->mask & IN_DELETE) {
		dbgprintf("INOTIFY event: watch IN_DELETE\n");
	}
	if(ev->mask & IN_DELETE_SELF) {
		dbgprintf("INOTIFY event: watch IN_DELETE_SELF\n");
	}
	if(ev->mask & IN_MOVE_SELF) {
		dbgprintf("INOTIFY event: watch IN_MOVE_SELF\n");
	}
	if(ev->mask & IN_MOVED_FROM) {
		dbgprintf("INOTIFY event: watch IN_MOVED_FROM, cookie %u, name '%s'\n", ev->cookie, ev->name);
	}
	if(ev->mask & IN_MOVED_TO) {
		dbgprintf("INOTIFY event: watch IN_MOVED_TO, cookie %u, name '%s'\n", ev->cookie, ev->name);
	}
	if(ev->mask & IN_OPEN) {
		dbgprintf("INOTIFY event: watch IN_OPEN\n");
	}
	if(ev->mask & IN_ISDIR) {
		dbgprintf("INOTIFY event: watch IN_ISDIR\n");
	}
}


static void ATTR_NONNULL(1, 2)
in_handleFileEvent(struct inotify_event *ev, const wd_map_t *const etry)
{
	if(ev->mask & IN_MODIFY) {
		DBGPRINTF("fs_node_notify_file_update: act->name '%s'\n", etry->act->name);
		pollFile(etry->act);
	} else {
		DBGPRINTF("got non-expected inotify event:\n");
		in_dbg_showEv(ev);
	}
}


/* workaround for IN_MOVED: walk active list and prevent state file deletion of
 * IN_MOVED_IN active object
 * TODO: replace by a more generic solution.
 */
static void
flag_in_move(fs_edge_t *const edge, const char *name_moved)
{
	act_obj_t *act;

	for(act = edge->active ; act != NULL ; act = act->next) {
		DBGPRINTF("checking active object %s\n", act->basename);
		if(!strcmp(act->basename, name_moved)){
			DBGPRINTF("found file\n");
			act->in_move = 1;
			break;
		} else {
			DBGPRINTF("name check fails, '%s' != '%s'\n", act->basename, name_moved);
		}
	}
	if (!act && edge->next) {
		flag_in_move(edge->next, name_moved);
	}
}

static void ATTR_NONNULL(1)
in_processEvent(struct inotify_event *ev)
{
	if(ev->mask & IN_IGNORED) {
		DBGPRINTF("imfile: got IN_IGNORED event\n");
		goto done;
	}

	DBGPRINTF("in_processEvent process Event %x for %s\n", ev->mask, ev->name);
	const wd_map_t *const etry =  wdmapLookup(ev->wd);
	if(etry == NULL) {
		LogMsg(0, RS_RET_INTERNAL_ERROR, LOG_WARNING, "imfile: internal error? "
			"inotify provided watch descriptor %d which we could not find "
			"in our tables - ignored", ev->wd);
		goto done;
	}
	DBGPRINTF("in_processEvent process Event %x is_file %d, act->name '%s'\n",
		ev->mask, etry->act->edge->is_file, etry->act->name);

	if((ev->mask & IN_MOVED_FROM)) {
		flag_in_move(etry->act->edge->node->edges, ev->name);
	}
	if(ev->mask & (IN_MOVED_FROM | IN_MOVED_TO))  {
		fs_node_walk(etry->act->edge->node, poll_tree);
	} else if(etry->act->edge->is_file && !(etry->act->is_symlink)) {
		in_handleFileEvent(ev, etry); // esentially poll_file()!
	} else {
		fs_node_walk(etry->act->edge->node, poll_tree);
	}
done:	return;
}


/* Monitor files in inotify mode */
static rsRetVal
do_inotify(void)
{
	char iobuf[8192];
	int rd;
	int currev;
	static int last_timeout = 0;
	struct pollfd pollfd;
	DEFiRet;

	CHKiRet(wdmapInit());
	ino_fd = inotify_init1(IN_NONBLOCK);
	if(ino_fd < 0) {
		LogError(errno, RS_RET_INOTIFY_INIT_FAILED, "imfile: Init inotify "
			"instance failed ");
		return RS_RET_INOTIFY_INIT_FAILED;
	}
	DBGPRINTF("inotify fd %d\n", ino_fd);

	do_initial_poll_run();

	while(glbl.GetGlobalInputTermState() == 0) {
		int r;

		pollfd.fd = ino_fd;
		pollfd.events = POLLIN;

		if (runModConf->haveReadTimeouts)
			r = poll(&pollfd, 1, runModConf->timeoutGranularity);
		else
			r = poll(&pollfd, 1, -1);

		if (r  == -1 && errno == EINTR) {
			DBGPRINTF("do_inotify interrupted while polling on ino_fd\n");
			continue;
		}
		if(r == 0) {
			DBGPRINTF("readTimeouts are configured, checking if some apply\n");
			if (runModConf->haveReadTimeouts) {
				fs_node_walk(runModConf->conf_tree, poll_timeouts);
				last_timeout = time(NULL);
			}
			continue;
		} else if (r == -1) {
			LogError(errno, RS_RET_INTERNAL_ERROR,
					"%s:%d: unexpected error during poll timeout wait",
					__FILE__, __LINE__);
			/* we do not abort, as this would render the whole input defunct */
			continue;
		} else if(r != 1) {
			LogError(errno, RS_RET_INTERNAL_ERROR,
					"%s:%d: ERROR: poll returned more fds (%d) than given to it (1)",
					__FILE__, __LINE__, r);
			/* we do not abort, as this would render the whole input defunct */
			continue;
		}
		else {
			// process timeouts always, ino_fd may be too busy to ever have timeout occur from poll
			if(runModConf->haveReadTimeouts) {
				int now = time(NULL);
				if(last_timeout + (runModConf->timeoutGranularity / 1000) > now) {
					fs_node_walk(runModConf->conf_tree, poll_timeouts);
					last_timeout = time(NULL);
				}
			}
			rd = read(ino_fd, iobuf, sizeof(iobuf));
			if(rd == -1 && errno == EINTR) {
				/* This might have been our termination signal! */
				DBGPRINTF("EINTR received during inotify, restarting poll\n");
				continue;
			}
			if (rd == -1 && errno == EWOULDBLOCK) {
				continue;
			}
			if(rd < 0) {
				LogError(errno, RS_RET_IO_ERROR, "imfile: error during inotify - ignored");
				continue;
			}
			currev = 0;
			while(currev < rd) {
				union {
					char *buf;
					struct inotify_event *ev;
				} savecast;
				savecast.buf = iobuf+currev;
				in_dbg_showEv(savecast.ev);
				in_processEvent(savecast.ev);
				currev += sizeof(struct inotify_event) + savecast.ev->len;
			}
		}
	}

finalize_it:
	close(ino_fd);
	RETiRet;
}

#else /* #if HAVE_INOTIFY_INIT */
static rsRetVal
do_inotify(void)
{
	LogError(0, RS_RET_NOT_IMPLEMENTED, "imfile: mode set to inotify, but the "
			"platform does not support inotify");
	return RS_RET_NOT_IMPLEMENTED;
}
#endif /* #if HAVE_INOTIFY_INIT */


/* --- Monitor files in FEN mode (OS_SOLARIS)*/
#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE) /* use FEN on Solaris! */
static void
fen_printevent(int event)
{
	if (event & FILE_ACCESS) {
		DBGPRINTF(" FILE_ACCESS");
	}
	if (event & FILE_MODIFIED) {
		DBGPRINTF(" FILE_MODIFIED");
	}
	if (event & FILE_ATTRIB) {
		DBGPRINTF(" FILE_ATTRIB");
	}
	if (event & FILE_DELETE) {
		DBGPRINTF(" FILE_DELETE");
	}
	if (event & FILE_RENAME_TO) {
		DBGPRINTF(" FILE_RENAME_TO");
	}
	if (event & FILE_RENAME_FROM) {
		DBGPRINTF(" FILE_RENAME_FROM");
	}
	if (event & UNMOUNTED) {
		DBGPRINTF(" UNMOUNTED");
	}
	if (event & MOUNTEDOVER) {
		DBGPRINTF(" MOUNTEDOVER");
	}
}


/* https://docs.oracle.com/cd/E19253-01/816-5168/port-get-3c/index.html */
static rsRetVal
do_fen(void)
{
	port_event_t portEvent;
	struct timespec timeout;
	DEFiRet;

	/* Set port timeout to 1 second. We need to check for unmonitored files during meantime */
	// TODO: do we need this timeout at all for equality to old code?
	// TODO: do we need it to support the timeout feature!
	timeout.tv_sec = 300;
	timeout.tv_nsec = 0;

	/* create port instance */
	if((glport = port_create()) == -1) {
		LogError(errno, RS_RET_FEN_INIT_FAILED, "do_fen INIT Port failed ");
		return RS_RET_FEN_INIT_FAILED;
	}

	do_initial_poll_run();

	DBGPRINTF("do_fen ENTER monitoring loop \n");
	while(glbl.GetGlobalInputTermState() == 0) {
		DBGPRINTF("do_fen loop begin... \n");
		/* Loop through events, if there are any */
		while (!port_get(glport, &portEvent, &timeout)) { // wie inotify-wait
			DBGPRINTF("do_fen: received port event with ");
			fen_printevent((int) portEvent.portev_events);
			DBGPRINTF("\n");
			if(portEvent.portev_source != PORT_SOURCE_FILE) {
				LogError(errno, RS_RET_SYS_ERR, "do_fen: Event from unexpected source "
					": %d\n", portEvent.portev_source);
				continue;
			}
			act_obj_t *const act = (act_obj_t*) portEvent.portev_user;
			DBGPRINTF("do_fen event received: deleted %d, is_file %d, name '%s' foname '%s'\n",
				act->is_deleted, act->edge->is_file, act->name,
				((struct file_obj*)portEvent.portev_object)->fo_name);
			if(act->is_deleted) {
				free(act->name);
				free(act);
				continue;
			}

			/* we need to re-associate the object */
			act->bPortAssociated = 0;
			fen_setupWatch(act);

			if(act->edge->is_file) {
				pollFile(act);
			} else {
				fs_node_walk(act->edge->node, poll_tree);
			}
		}
	}

	/* close port, will de-activate all file events watches associated
	 * with the port.
	 */
	close(glport);
	RETiRet;
}
#else /* #if OS_SOLARIS */
static rsRetVal
do_fen(void)
{
	LogError(0, RS_RET_NOT_IMPLEMENTED, "do_fen: mode set to fen, but the "
			"platform does not support fen");
	return RS_RET_NOT_IMPLEMENTED;
}
#endif /* #if OS_SOLARIS */


/* This function is called by the framework to gather the input. The module stays
 * most of its lifetime inside this function. It MUST NEVER exit this function. Doing
 * so would end module processing and rsyslog would NOT reschedule the module. If
 * you exit from this function, you violate the interface specification!
 */
BEGINrunInput
CODESTARTrunInput
	#if defined(OS_SOLARIS) && defined (HAVE_PORT_SOURCE_FILE) /* use FEN on Solaris! */
	if(runModConf->opMode == OPMODE_INOTIFY) {
		DBGPRINTF("auto-adjusting 'inotify' mode to 'fen' on Solaris\n");
		runModConf->opMode = OPMODE_FEN;
	}
	#endif
	DBGPRINTF("working in %s mode\n",
		 (runModConf->opMode == OPMODE_POLLING) ? "polling" :
			((runModConf->opMode == OPMODE_INOTIFY) ?"inotify" : "fen"));
	if(runModConf->opMode == OPMODE_POLLING)
		iRet = doPolling();
	else if(runModConf->opMode == OPMODE_INOTIFY)
		iRet = do_inotify();
	else if(runModConf->opMode == OPMODE_FEN)
		iRet = do_fen();
	else {
		LogError(0, RS_RET_NOT_IMPLEMENTED, "imfile: unknown mode %d set",
			runModConf->opMode);
		return RS_RET_NOT_IMPLEMENTED;
	}
	DBGPRINTF("terminating upon request of rsyslog core\n");
ENDrunInput


/* The function is called by rsyslog before runInput() is called. It is a last chance
 * to set up anything specific. Most importantly, it can be used to tell rsyslog if the
 * input shall run or not. The idea is that if some config settings (or similiar things)
 * are not OK, the input can tell rsyslog it will not execute. To do so, return
 * RS_RET_NO_RUN or a specific error code. If RS_RET_OK is returned, rsyslog will
 * proceed and call the runInput() entry point.
 */
BEGINwillRun
CODESTARTwillRun
	/* we need to create the inputName property (only once during our lifetime) */
	CHKiRet(prop.Construct(&pInputName));
	CHKiRet(prop.SetString(pInputName, UCHAR_CONSTANT("imfile"), sizeof("imfile") - 1));
	CHKiRet(prop.ConstructFinalize(pInputName));
finalize_it:
ENDwillRun

// TODO: refactor this into a generically-usable "atomic file creation" utility for
// all kinds of "state files"
static rsRetVal ATTR_NONNULL()
atomicWriteStateFile(const char *fn, const char *content)
{
	DEFiRet;
	const int fd = open(fn, O_CLOEXEC | O_NOCTTY | O_WRONLY | O_CREAT | O_TRUNC, 0600);
	if(fd < 0) {
		LogError(errno, RS_RET_IO_ERROR, "imfile: cannot open state file '%s' for "
			"persisting file state - some data will probably be duplicated "
			"on next startup", fn);
		ABORT_FINALIZE(RS_RET_IO_ERROR);
	}

	const size_t toWrite = strlen(content);
	const ssize_t w = write(fd, content, toWrite);
	if(w != (ssize_t) toWrite) {
		LogError(errno, RS_RET_IO_ERROR, "imfile: partial write to state file '%s' "
			"this may cause trouble in the future. We will try to delete the "
			"state file, as this provides most consistent state", fn);
		unlink(fn);
		ABORT_FINALIZE(RS_RET_IO_ERROR);
	}

finalize_it:
	if(fd >= 0) {
		close(fd);
	}
	RETiRet;
}

/* This function should be called after any file ID change - that is if
 * file grown from hash-only statefile, or was truncated, this will ensure
 * we delete the old file so we do not make garbage in our working dir and
 * there are no leftover statefiles which can in theory later bind to something
 * and cause data loss.
 * jvymazal 2019-11-27
 */
static void
removeOldStatefile(const uchar *statefn, const char *hashToDelete)
{
	int ret;
	uchar statefname[MAXFNAME];

	getFullStateFileName(statefn, hashToDelete, statefname, sizeof(statefname));
	DBGPRINTF("removing old state file: '%s'\n", statefname);
	ret = unlink((const char*)statefname);
	if(ret != 0) {
		if (errno != ENOENT) {
			LogError(errno, RS_RET_IO_ERROR,
				"imfile error trying to delete old state file: '%s' - ignoring this "
				"error, usually this means a file no longer file is left over, but "
				"this may also cause some real trouble. Still the best we can do ",
				statefname);
		} else {
			DBGPRINTF("trying to delete no longer valid statefile '%s' which no "
					  "longer exists (probably already deleted)\n", statefname);
		}
	}
}


/* This function persists information for a specific file being monitored.
 * To do so, it simply persists the stream object. We do NOT abort on error
 * iRet as that makes matters worse (at least we can try persisting the others...).
 * rgerhards, 2008-02-13
 */
static rsRetVal ATTR_NONNULL()
persistStrmState(act_obj_t *const act)
{
	DEFiRet;
	uchar statefile[MAXFNAME];
	uchar statefname[MAXFNAME];

	uchar *const statefn = getStateFileName(act, statefile, sizeof(statefile));
	getFileID(act);
	getFullStateFileName(statefn, act->file_id, statefname, sizeof(statefname));
	DBGPRINTF("persisting state for '%s', state file '%s'\n", act->name, statefname);

	struct json_object *jval = NULL;
	struct json_object *json = NULL;
	CHKmalloc(json = json_object_new_object());
	jval = json_object_new_string((char*) act->name);
	json_object_object_add(json, "filename", jval);
	jval = json_object_new_int(strmGetPrevWasNL(act->pStrm));
	json_object_object_add(json, "prev_was_nl", jval);

	/* we access some data items a bit dirty, as we need to refactor the whole
	 * thing in any case - TODO
	 */
	jval = json_object_new_int64(act->pStrm->iCurrOffs);
	json_object_object_add(json, "curr_offs", jval);
	jval = json_object_new_int64(act->pStrm->strtOffs);
	json_object_object_add(json, "strt_offs", jval);

	const uchar *const prevLineSegment = strmGetPrevLineSegment(act->pStrm);
	if(prevLineSegment != NULL) {
		jval = json_object_new_string((const char*) prevLineSegment);
		json_object_object_add(json, "prev_line_segment", jval);
	}

	const uchar *const prevMsgSegment = strmGetPrevMsgSegment(act->pStrm);
	if(prevMsgSegment != NULL) {
		jval = json_object_new_string((const char*) prevMsgSegment);
		json_object_object_add(json, "prev_msg_segment", jval);
	}

	const char *jstr =  json_object_to_json_string_ext(json, JSON_C_TO_STRING_SPACED);

	CHKiRet(atomicWriteStateFile((const char*)statefname, jstr));
	json_object_put(json);

	/* file-id changed remove the old statefile */
	if (strncmp((const char *)act->file_id_prev, (const char *)act->file_id, FILE_ID_HASH_SIZE)) {
		removeOldStatefile(statefn, act->file_id_prev);
	}

finalize_it:
	if(iRet != RS_RET_OK) {
		LogError(0, iRet, "imfile: could not persist state "
				"file %s - data may be repeated on next "
				"startup. Is WorkDirectory set?",
				statefname);
	}

	RETiRet;
}

/* This function is called by the framework after runInput() has been terminated. It
 * shall free any resources and prepare the module for unload.
 */
BEGINafterRun
CODESTARTafterRun
	if(pInputName != NULL)
		prop.Destruct(&pInputName);
ENDafterRun


BEGINisCompatibleWithFeature
CODESTARTisCompatibleWithFeature
	if(eFeat == sFEATURENonCancelInputTermination)
		iRet = RS_RET_OK;
ENDisCompatibleWithFeature


/* The following entry points are defined in module-template.h.
 * In general, they need to be present, but you do NOT need to provide
 * any code here.
 */
BEGINmodExit
CODESTARTmodExit
	/* release objects we used */
	objRelease(strm, CORE_COMPONENT);
	objRelease(glbl, CORE_COMPONENT);
	objRelease(prop, CORE_COMPONENT);
	objRelease(ruleset, CORE_COMPONENT);
	objRelease(datetime, CORE_COMPONENT);

	#ifdef HAVE_INOTIFY_INIT
	free(wdmap);
	#endif
ENDmodExit


BEGINqueryEtryPt
CODESTARTqueryEtryPt
CODEqueryEtryPt_STD_IMOD_QUERIES
CODEqueryEtryPt_STD_CONF2_QUERIES
CODEqueryEtryPt_STD_CONF2_setModCnf_QUERIES
CODEqueryEtryPt_STD_CONF2_IMOD_QUERIES
CODEqueryEtryPt_IsCompatibleWithFeature_IF_OMOD_QUERIES
ENDqueryEtryPt


/* The following function shall reset all configuration variables to their
 * default values. The code provided in modInit() below registers it to be
 * called on "$ResetConfigVariables". You may also call it from other places,
 * but in general this is not necessary. Once runInput() has been called, this
 * function here is never again called.
 */
static rsRetVal
resetConfigVariables(uchar __attribute__((unused)) *pp, void __attribute__((unused)) *pVal)
{
	DEFiRet;

	free(cs.pszFileName);
	cs.pszFileName = NULL;
	free(cs.pszFileTag);
	cs.pszFileTag = NULL;
	free(cs.pszStateFile);
	cs.pszStateFile = NULL;

	/* set defaults... */
	cs.iPollInterval = DFLT_PollInterval;
	cs.iFacility = 128; /* local0 */
	cs.iSeverity = 5;  /* notice, as of rfc 3164 */
	cs.readMode = 0;
	cs.maxLinesAtOnce = 10240;
	cs.trimLineOverBytes = 0;

	RETiRet;
}

static inline void
std_checkRuleset_genErrMsg(__attribute__((unused)) modConfData_t *modConf, instanceConf_t *inst)
{
	LogError(0, NO_ERRCODE, "imfile: ruleset '%s' for %s not found - "
			"using default ruleset instead", inst->pszBindRuleset,
			inst->pszFileName);
}

/* modInit() is called once the module is loaded. It must perform all module-wide
 * initialization tasks. There are also a number of housekeeping tasks that the
 * framework requires. These are handled by the macros. Please note that the
 * complexity of processing is depending on the actual module. However, only
 * thing absolutely necessary should be done here. Actual app-level processing
 * is to be performed in runInput(). A good sample of what to do here may be to
 * set some variable defaults.
 */
BEGINmodInit()
CODESTARTmodInit
	*ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */
CODEmodInit_QueryRegCFSLineHdlr
	CHKiRet(objUse(glbl, CORE_COMPONENT));
	CHKiRet(objUse(strm, CORE_COMPONENT));
	CHKiRet(objUse(ruleset, CORE_COMPONENT));
	CHKiRet(objUse(prop, CORE_COMPONENT));
	CHKiRet(objUse(datetime, CORE_COMPONENT));

	DBGPRINTF("version %s initializing\n", VERSION);
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilename", 0, eCmdHdlrGetWord,
	  	NULL, &cs.pszFileName, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfiletag", 0, eCmdHdlrGetWord,
	  	NULL, &cs.pszFileTag, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilestatefile", 0, eCmdHdlrGetWord,
	  	NULL, &cs.pszStateFile, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfileseverity", 0, eCmdHdlrSeverity,
	  	NULL, &cs.iSeverity, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilefacility", 0, eCmdHdlrFacility,
	  	NULL, &cs.iFacility, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilereadmode", 0, eCmdHdlrInt,
	  	NULL, &cs.readMode, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilemaxlinesatonce", 0, eCmdHdlrSize,
	  	NULL, &cs.maxLinesAtOnce, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfiletrimlineoverbytes", 0, eCmdHdlrSize,
	  	NULL, &cs.trimLineOverBytes, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilepersiststateinterval", 0, eCmdHdlrInt,
	  	NULL, &cs.iPersistStateInterval, STD_LOADABLE_MODULE_ID));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputfilebindruleset", 0, eCmdHdlrGetWord,
		NULL, &cs.pszBindRuleset, STD_LOADABLE_MODULE_ID));
	/* that command ads a new file! */
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"inputrunfilemonitor", 0, eCmdHdlrGetWord,
		addInstance, NULL, STD_LOADABLE_MODULE_ID));
	/* module-global config params - will be disabled in configs that are loaded
	 * via module(...).
	 */
	CHKiRet(regCfSysLineHdlr2((uchar *)"inputfilepollinterval", 0, eCmdHdlrInt,
	  	NULL, &cs.iPollInterval, STD_LOADABLE_MODULE_ID, &bLegacyCnfModGlobalsPermitted));
	CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler,
		resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID));
ENDmodInit