unix-dgram: fixed message processing w/o terminating newlines

In the last refactor, unix-dgram was switched to use the "text" LogProto

Since unix-dgram clients don't always supply an NL character
(such as on FreeBSD), this caused issues.

This patch fixes the issue and also extends the testcases to cover this.

Reported-by: Peter Czanik <czanik@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
plugin: don't emit module loaded successfully unless verbose mode is enabled

Interactive tools load plugins, but the information about this being
successful is not very important. Make this a 'verbose' message.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
pdbtool dump: fixed -p option parsing

And also added a warning if neither -T or -P was specified.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
db-parser: allow dash in class names

Reported-By: Evan Rempel <erempel@uvic.ca>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
dbparser: create a separate directory for pdbtool

As I'd like to split the pdbtool source code to several files, which
would clutter the db-parser directory.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
db-parser: added @PCRE@ parser

This patch implements the @PCRE@ parser in db-parser() patterns. With
this you can use the power of regexps once the heavylifting of identifying
the potential patterns happened by the radix implementation.

Syntax:
  @PCRE:name:regexp@

As the name suggests regexp is a Perl-Compatible Regular Expression as
implemented by the PCRE library.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
logproto: Introduce an indented multiline server class

The indented multiline class is derived from LogProtoTextServer, the
main difference is in determining what constitutes a full line: while
the text server considers a newline as a terminator, the indented
multiline server has stricter requirements: the newline must be
followed by another line that does not start with whitespace.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Add an "indented-multiline" logreader flag

Teach logreader to accept "indented-multiline" as a flag, so that
affile and afsocket can look for it, and set the proto to
indented-multiline instead of text if the flag's found.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
linux-kmsg-format: New format plugin to parse /dev/kmsg messages

With linux 3.5, /dev/kmsg was changed substantially, and it now emits
structured kernel messages towards userspace. For its format, see
Documentation/ABI/testing/dev-kmsg in a recent kernel source.

This format plugin implements the parser for that format, including
special parsing for the DEVICE keys, and resolving of the message
timestamps on Linux.

To use it on a 3.5+ kernel, something along these lines should replace
the /proc/kmsg source:

  file("/dev/kmsg"
       flags(kernel, indented-multiline)
       program-override("kernel")
       format("linux-kmsg"));

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
affile: Treat /dev/kmsg on linux specially

On Linux, use a dgram reader for /dev/kmsg, because it works almost
exactly like a dgram source anyway, and a dgram reader is more
efficient than the indented-multiline one.

Also, change the system() source to not enforce indentedn-multiline on
/dev/kmsg anymore, since with the change to affile, there's no need
to.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
system-source: Add Linux 3.5+ /dev/kmsg support

When on Linux, and /dev/kmsg is seekable, use that over /proc/kmsg,
using indented-multiline and the linux-kmsg format.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>