Fix compilation errors in afsql and tfgeoip

The afsql and tfgeoip modules need to include plugin-types.h to
compile, as they need constants that were moved there recently.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
pacctformat: Compilation fix

Include plugin-types.h in pacct-format-plugin.c too, as we use
constants from it.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
travis: Configure with --enable-pacct

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
log_msg_clear: fixed two issues that caused log_msg_clear()-ed struct to become inconsistent

The function went unused and rot to the point that it didn't handle
inline-tags and borrowed SDATA properly.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
msg_parse_lib.h: added MSG_TESTCASE macro

To make it easier to write LogMessage related testcases, in a similar
vein to PROTO_TESTCASE.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
test_log_message: skeleton for a LogMessage unit test

This program implements a testcase for log_msg_clear() that was used
to discover it deficiencies.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
msg_format_inject_parse_error: new function to format a "parse-error" message

Instead of open coding this in syslogformat and linux-kmsg-format, centralize
the functionality here.

Was changed somewhat to use log_msg_clear()

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
syslog-format: use msg_format_inject_parse_error
affile: only use 10 seconds timeout for /proc/kmsg

We use a 10 seconds timeout when reading /proc/kmsg as a workaround against
/proc/kmsg blocking (which may happen when there are multiple readers).

The new /dev/kmsg doesn't need this, so make this a special case.

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
linux-kmsg-format: New format plugin to parse /dev/kmsg messages

With linux 3.5, /dev/kmsg was changed substantially, and it now emits
structured kernel messages towards userspace. For its format, see
Documentation/ABI/testing/dev-kmsg in a recent kernel source.

This format plugin implements the parser for that format, including
special parsing for the DEVICE keys, and resolving of the message
timestamps on Linux (the monotonic timestamp is stored too
nevertheless).

To use it on a 3.5+ kernel, something along these lines should replace
the /proc/kmsg source:

  file("/dev/kmsg"
       flags(kernel)
       program-override("kernel")
       format("linux-kmsg"));

Signed-off-by: Gergely Nagy <algernon@balabit.hu>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
affile: Treat /dev/kmsg on linux specially

On Linux, use a dgram reader for /dev/kmsg, because it works almost
exactly like a dgram source anyway, and a dgram reader is more
efficient than the indented-multiline one.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>

Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
system-source: Add Linux 3.5+ /dev/kmsg support

When on Linux, and /dev/kmsg is seekable, use that over /proc/kmsg,
using indented-multiline and the linux-kmsg format.

Signed-off-by: Gergely Nagy <algernon@balabit.hu>