systemd-journal: Prefer SYSLOG_IDENTIFIER over _COMM

In order to not break assumptions, prefer SYSLOG_IDENTIFIER over _COMM.
For example, postfix uses postfix/qmgr as SYSLOG_IDENTIFIER, but _COMM
is only "qmgr". The journal itself uses SYSLOG_IDENTIFIER when
reconstructing the syslog message, so we should not deviate from that
behaviour, either.

Similarly, rsyslog also prefers SYSLOG_IDENTIFIER, so for the sake of
compatibility, doing the same is preferable.

Reported-by: Alexander Görtz
Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
service-management: if previous code was compiled with ENABLE_SYSTEMD,

the systemd service manager will be the current service manager,
even that systemd wasn't active.

Signed-off-by: Juhász Viktor <jviktor@balabit.hu>
system-source: Demote the json-parser() warning to a debug message

Not having the json module installed by default is fairly common, @cim
messages on the other hand, are not. To make startup less annoying for a
large number of users, demote the warning about json-parser() missing to
a debug message.

This addresses one part of #329.

Reported-by: Peter Czanik <czanik@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
hostname: Demote the FQDN warning to a verbose message

On a lot of desktop machines (and in private networks), the hostname
will not be fully qualified, so the warning is just noise. Demote it to
a message only displayed in verbose mode.

This fixes the other half of #329.

Reported-by: Peter Czanik <czanik@balabit.hu>
Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
Merge pull request #330 from algernon/h/3.6/annoying-startup-messages

Silence two annoying startup messages
afsocket: rename log_transport_unix_socket_new to _dgram_socket_new()

When doing the LogTransport refactor in early 3.6 days, one difference
between unix-dgram() and unix-stream() were not taken into consideration:
zero-length packets should only be ignored for SOCK_DGRAM transports and
not for SOCK_STREAM ones.

This is a preparatory patch to fix the issue this bug causes, it renames
the original constructor function to log_transport_unix_dgram_socket_new()
by adding the _dgram_ qualifier, otherwise it doesn't change functionality.

The fix is coming in a subsequent patch.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
afsocket: add log_transport_unix_stream_socket_new() function

This patch adds a SOCK_STREAM specific AF_UNIX socket transport
implementation.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
afsocket: fix spinning on EOF for unix-stream() sockets

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
afsocket: fix shift/reduce conflicts in grammar

Due to a stray colon, the grammar contained a conflict as both
source_systemd_syslog_option and its recursive parent
source_systemd_syslog_options permitted an empty evaluation.

By removing the extra colon, only the "options" rule allows the empty
match, which in turn removes the conflict.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
afsocket: fix indentation issues in the grammar file
logproto-regexp-multiline-server: fix compilation warnings about mismatching character signs

The types used for detecting the message boundaries were not consistently
used and some of the call-sites lacked type-casts. This patch fixes
that up by consistently using guchar * for detecting line endings,
and only casting it to a gchar * when passing it on to pcre.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
test_rewrite: always use the current config version in the tests

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
test_rewrite: fix compilation warning due to a pointer type mismatch

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
test_rewrite: rename local LogPipe API extension

The test program contained a function that was named like as it was part
of the LogPipe API, called log_pipe_queue_with_default_path_options().
call that invoke_rewrite_rule() instead, that reflects its purpose
much better. If we need the API extension, we should do that in the
core.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
Makefile: remove explicit libsyslog-ng-crypto references

Instead of open-coding the optional libsyslog-ng-crypto as a dependency
use $(CRYPTO_LIBS) which conditionally contains the same if
libsyslog-ng-crypto is built.

Signed-off-by: Balazs Scheidler <balazs.scheidler@balabit.com>
Merge pull request #327 from juhaszviktor/f/service-manager-fix

service-management: if previous code was compiled with ENABLE_SYSTEMD,
riemann: Do not crash without attributes() set

When using a riemann destination, do not crash when no attributes are
set.

Signed-off-by: Gergely Nagy <algernon@madhouse-project.org>
Merge pull request #321 from algernon/h/riemann/fix-no-attributes

riemann: Do not crash without attributes() set
Merge pull request #325 from algernon/h/systemd/journal-syslog-identifier

systemd-journal: Prefer SYSLOG_IDENTIFIER over _COMM
Merge pull request #335 from balabit/3.6/f/fix-warnings

3.6/f/fix warnings