system-source: Do not use /dev/kmsg when using systemd

When using the Journal, do not use /dev/kmsg, because that is included
in the journal too, and using it would lead to log duplication.

Reported-by: Andras Mitzki <micek@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
system-source: Linux Containers should not touch /*/kmsg

The /proc/kmsg (or /dev/kmsg) files are shared between host and
container, the containers should not concern themselves with it. This
patch fixes #254, by trying to detect LXC.

The detection works by opening /proc/1/cgroup, and seeing if any of the
lines end with anything other than "/". If they do, we assume we're in a
container, as the host init will have all its cgroups set to the root.

Requested-by: György PÁSZTOR <pasztor@linux.gyakg.u-szeged.hu>
Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
Merge pull request #255 from algernon/f/3.6/system-source/lxc-detect

system-source: Linux Containers should not touch /*/kmsg
Preparations for syslog-ng 3.6.0beta2

Bumped the version in VERSION, and added noteworthy changes to NEWS.md.

Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
value-pairs: Made value-pairs refcounted.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
testutils: Added high-level assertion for checking log message fields.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
rewrite: Fix a memory leak during configuration parsing.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
libtest: Added config parse functions for tests.

With parse_config function, developers can easily parse config snippets.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
rewrite: Reference the condition when cloning the rewrite object.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
groupset: Added groupset rewrite object.

Groupset allows the user to set multiple log message properties at once.
It also allows the user to reference the old value of the property
as the $_ macro.

Example:

rewrite r_hash { groupset( "$(hash $_)" values("user.*" "secret.*") ); };

In this example, all properties which matches glob pattern "user.*" or "secret.*"
are hashed.

As the first parameter any valid template is permitted.
In the "values" section, user can specify a list of glob patterns.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
rewrite: Added unit tests for rewrite functionality.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
rewrite: Use "values" keyword instead of "fields" in grammar.

Also renamed multiset_opts to groupset_opts in grammar rules.

Signed-off-by: Viktor Tusa <tusa@balabit.hu>
Merge pull request #256 from talien/f/rewrite-groupset

F/rewrite groupset
Change control socket message from notice to debug

In 3.3 or 3.4, syslog-ng started emitting log lines whenever a control socket was closed.  This isn't very useful and can be pretty noisy if the control socket is used regularly to collect statistics.

This commit changes the level to debug so the lines do not show up under normal usage.
Merge pull request #262 from bldewolf/re-classify-control-socket-EOF-log-lines

Change control socket message from notice to debug
test_systemd_journal: do not check HOST_FROM, because it is not set by the journal_reader

Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com>
journald-mock: do not use pipe2() which is linux(glibc>=2.9)-specific

Signed-off-by: Budai Laszlo <Laszlo.Budai@balabit.com>
systemd-journal: use the sd_journal_get_realtime_usec instead of _SOURCE_REALTIME_TIMESTAMP field

Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com>
systemd-journal: Added debug message for incoming messages from journal.

Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com>
systemd-journal: only one instance is acceptable

Signed-off-by: Juhász Viktor <viktor.juhasz@balabit.com>