X-Git-Url: https://git.octo.it/?a=blobdiff_plain;f=src%2Fsysevent.c;h=b63767dbcb0089024c14ea99b9ec5354080e2266;hb=950876683f3b214072e9295cee21999ed726cd83;hp=4948b2b87bd4b492ea3cafbc92b723e5ba022891;hpb=d1ccfe03250e65090f92142c7002abf7a6a60ec5;p=collectd.git

diff --git a/src/sysevent.c b/src/sysevent.c
index 4948b2b8..b63767db 100644
--- a/src/sysevent.c
+++ b/src/sysevent.c
@@ -26,10 +26,10 @@
 
 #include "collectd.h"
 
-#include "common.h"
 #include "plugin.h"
+#include "utils/common/common.h"
+#include "utils/ignorelist/ignorelist.h"
 #include "utils_complain.h"
-#include "utils_ignorelist.h"
 
 #include <errno.h>
 #include <netdb.h>
@@ -95,18 +95,23 @@ typedef struct {
   int tail;
   int maxLen;
   char **buffer;
-  long long unsigned int *timestamp;
+  cdtime_t *timestamp;
 } circbuf_t;
 
 /*
  * Private variables
  */
+
 static ignorelist_t *ignorelist = NULL;
 
-static int sysevent_thread_loop = 0;
-static int sysevent_thread_error = 0;
-static pthread_t sysevent_thread_id;
-static pthread_mutex_t sysevent_lock = PTHREAD_MUTEX_INITIALIZER;
+static int sysevent_socket_thread_loop = 0;
+static int sysevent_socket_thread_error = 0;
+static pthread_t sysevent_socket_thread_id;
+static int sysevent_dequeue_thread_loop = 0;
+static pthread_t sysevent_dequeue_thread_id;
+static pthread_mutex_t sysevent_thread_lock = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t sysevent_data_lock = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t sysevent_cond = PTHREAD_COND_INITIALIZER;
 static int sock = -1;
 static int event_id = 0;
 static circbuf_t ring;
@@ -129,16 +134,14 @@ static const char *rsyslog_field_keys[5] = {
  */
 
 static int gen_message_payload(const char *msg, char *sev, int sev_num,
-                               char *process, char *host,
-                               long long unsigned int timestamp, char **buf) {
+                               char *process, char *host, cdtime_t timestamp,
+                               char **buf) {
   const unsigned char *buf2;
   yajl_gen g;
   char json_str[DATA_MAX_NAME_LEN];
 
 #if !defined(HAVE_YAJL_V2)
-  yajl_gen_config conf = {};
-
-  conf.beautify = 0;
+  yajl_gen_config conf = {0};
 #endif
 
 #if HAVE_YAJL_V2
@@ -172,9 +175,7 @@ static int gen_message_payload(const char *msg, char *sev, int sev_num,
     goto err;
 
   event_id = event_id + 1;
-  int event_id_len = sizeof(char) * sizeof(int) * 4 + 1;
-  memset(json_str, '\0', DATA_MAX_NAME_LEN);
-  snprintf(json_str, event_id_len, "%d", event_id);
+  snprintf(json_str, sizeof(json_str), "%d", event_id);
 
   if (yajl_gen_number(g, json_str, strlen(json_str)) != yajl_gen_status_ok) {
     goto err;
@@ -185,13 +186,7 @@ static int gen_message_payload(const char *msg, char *sev, int sev_num,
                       strlen(SYSEVENT_EVENT_NAME_FIELD)) != yajl_gen_status_ok)
     goto err;
 
-  int event_name_len = 0;
-  event_name_len = event_name_len + strlen(host); // host name
-  event_name_len =
-      event_name_len +
-      22; // "host", "rsyslog", "message", 3 spaces and null-terminator
-  memset(json_str, '\0', DATA_MAX_NAME_LEN);
-  snprintf(json_str, event_name_len, "host %s rsyslog message", host);
+  snprintf(json_str, sizeof(json_str), "host %s rsyslog message", host);
 
   if (yajl_gen_string(g, (u_char *)json_str, strlen(json_str)) !=
       yajl_gen_status_ok) {
@@ -204,11 +199,7 @@ static int gen_message_payload(const char *msg, char *sev, int sev_num,
       yajl_gen_status_ok)
     goto err;
 
-  int last_epoch_microsec_len =
-      sizeof(char) * sizeof(long long unsigned int) * 4 + 1;
-  memset(json_str, '\0', DATA_MAX_NAME_LEN);
-  snprintf(json_str, last_epoch_microsec_len, "%llu",
-           (long long unsigned int)CDTIME_T_TO_US(cdtime()));
+  snprintf(json_str, sizeof(json_str), "%" PRIu64, CDTIME_T_TO_US(cdtime()));
 
   if (yajl_gen_number(g, json_str, strlen(json_str)) != yajl_gen_status_ok) {
     goto err;
@@ -282,11 +273,7 @@ static int gen_message_payload(const char *msg, char *sev, int sev_num,
       yajl_gen_status_ok)
     goto err;
 
-  int start_epoch_microsec_len =
-      sizeof(char) * sizeof(long long unsigned int) * 4 + 1;
-  memset(json_str, '\0', DATA_MAX_NAME_LEN);
-  snprintf(json_str, start_epoch_microsec_len, "%llu",
-           (long long unsigned int)timestamp);
+  snprintf(json_str, sizeof(json_str), "%" PRIu64, CDTIME_T_TO_US(timestamp));
 
   if (yajl_gen_number(g, json_str, strlen(json_str)) != yajl_gen_status_ok) {
     goto err;
@@ -387,27 +374,23 @@ static int gen_message_payload(const char *msg, char *sev, int sev_num,
                       strlen(SYSEVENT_SYSLOG_TAG_VALUE)) != yajl_gen_status_ok)
     goto err;
 
-  if (yajl_gen_map_close(g) != yajl_gen_status_ok)
-    goto err;
-
   // *** END syslog fields ***
 
-  if (yajl_gen_map_close(g) != yajl_gen_status_ok)
+  // close syslog and header fields
+  if (yajl_gen_map_close(g) != yajl_gen_status_ok ||
+      yajl_gen_map_close(g) != yajl_gen_status_ok)
     goto err;
 
   if (yajl_gen_get_buf(g, &buf2, &len) != yajl_gen_status_ok)
     goto err;
 
-  *buf = malloc(strlen((char *)buf2) + 1);
+  *buf = strdup((char *)buf2);
 
-  if (*buf == NULL)
-  {
-    ERROR("sysevent plugin: gen_message_payload malloc failed");
+  if (*buf == NULL) {
+    ERROR("sysevent plugin: gen_message_payload strdup failed");
     goto err;
   }
 
-  sstrncpy(*buf, (char *)buf2, strlen((char *)buf2) + 1);
-
   yajl_gen_free(g);
 
   return 0;
@@ -418,125 +401,431 @@ err:
   return -1;
 }
 
-static void *sysevent_thread(void *arg) /* {{{ */
-{
-  pthread_mutex_lock(&sysevent_lock);
-
-  while (sysevent_thread_loop > 0) {
-    int status = 0;
-
-    pthread_mutex_unlock(&sysevent_lock);
+static int read_socket() {
+  int recv_flags = MSG_DONTWAIT;
 
-    if (sock == -1)
-      return ((void *)0);
-
-    char buffer[listen_buffer_size];
+  while (42) {
     struct sockaddr_storage src_addr;
     socklen_t src_addr_len = sizeof(src_addr);
 
+    char buffer[listen_buffer_size];
     memset(buffer, '\0', listen_buffer_size);
 
-    ssize_t count = recvfrom(sock, buffer, sizeof(buffer), 0,
+    ssize_t count = recvfrom(sock, buffer, sizeof(buffer), recv_flags,
                              (struct sockaddr *)&src_addr, &src_addr_len);
 
-    if (count == -1) {
-      ERROR("sysevent plugin: failed to receive data: %s", strerror(errno));
-      status = -1;
-    } else if (count >= sizeof(buffer)) {
+    if (count < 0) {
+      if (errno == EAGAIN || errno == EWOULDBLOCK) {
+        pthread_mutex_lock(&sysevent_data_lock);
+
+        // There was nothing more to receive for now, so...
+        // If ring head does not equal ring tail, there is data
+        // in the ring buffer for the dequeue thread to read, so
+        // signal it
+        if (ring.head != ring.tail)
+          pthread_cond_signal(&sysevent_cond);
+
+        pthread_mutex_unlock(&sysevent_data_lock);
+
+        // Since there was nothing to receive, set recv to block and
+        // try again
+        recv_flags = 0;
+        continue;
+      } else if (errno != EINTR) {
+        ERROR("sysevent plugin: failed to receive data: %s", STRERRNO);
+        return -1;
+      } else {
+        // Interrupt, so continue and try again
+        continue;
+      }
+    }
+
+    if (count >= sizeof(buffer)) {
       WARNING("sysevent plugin: datagram too large for buffer: truncated");
+    }
+
+    // We successfully received a message, so don't block on the next
+    // read in case there are more (and if there aren't, it will be
+    // handled above in the EWOULDBLOCK error-checking)
+    recv_flags = MSG_DONTWAIT;
+
+    // 1. Acquire data lock
+    // 2. Push to buffer if there is room, otherwise raise warning
+    //    and allow dequeue thread to take over
+
+    pthread_mutex_lock(&sysevent_data_lock);
+
+    int next = ring.head + 1;
+    if (next >= ring.maxLen)
+      next = 0;
+
+    if (next == ring.tail) {
+      // Buffer is full, signal the dequeue thread to process the buffer
+      // and clean it out, and then sleep
+      WARNING("sysevent plugin: ring buffer full");
+
+      pthread_cond_signal(&sysevent_cond);
+      pthread_mutex_unlock(&sysevent_data_lock);
+
+      usleep(1000);
+      continue;
     } else {
-      // 1. Acquire lock
-      // 2. Push to buffer if there is room, otherwise raise warning
+      DEBUG("sysevent plugin: writing %s", buffer);
+
+      strncpy(ring.buffer[ring.head], buffer, sizeof(buffer));
+      ring.timestamp[ring.head] = cdtime();
+      ring.head = next;
+    }
 
-      pthread_mutex_lock(&sysevent_lock);
+    pthread_mutex_unlock(&sysevent_data_lock);
+  }
+}
 
-      int next = ring.head + 1;
-      if (next >= ring.maxLen)
-        next = 0;
+static void sysevent_dispatch_notification(const char *message,
+#if HAVE_YAJL_V2
+                                           yajl_val *node,
+#endif
+                                           cdtime_t timestamp) {
+  char *buf = NULL;
 
-      if (next == ring.tail) {
-        WARNING("sysevent plugin: ring buffer full");
-      } else {
-        DEBUG("sysevent plugin: writing %s", buffer);
+  notification_t n = {
+      .severity = NOTIF_OKAY,
+      .time = cdtime(),
+      .plugin = "sysevent",
+      .type = "gauge",
+  };
+
+#if HAVE_YAJL_V2
+  if (node != NULL) {
+    // If we have a parsed-JSON node to work with, use that
+    // msg
+    const char *msg_path[] = {rsyslog_keys[2], (const char *)0};
+    yajl_val msg_v = yajl_tree_get(*node, msg_path, yajl_t_string);
+
+    char msg[listen_buffer_size];
+
+    if (msg_v != NULL) {
+      memset(msg, '\0', listen_buffer_size);
+      snprintf(msg, listen_buffer_size, "%s%c", YAJL_GET_STRING(msg_v), '\0');
+    }
+
+    // severity
+    const char *severity_path[] = {"@fields", rsyslog_field_keys[1],
+                                   (const char *)0};
+    yajl_val severity_v = yajl_tree_get(*node, severity_path, yajl_t_string);
+
+    char severity[listen_buffer_size];
 
-        strncpy(ring.buffer[ring.head], buffer, sizeof(buffer));
-        ring.timestamp[ring.head] =
-            (long long unsigned int)CDTIME_T_TO_US(cdtime());
-        ring.head = next;
+    if (severity_v != NULL) {
+      memset(severity, '\0', listen_buffer_size);
+      snprintf(severity, listen_buffer_size, "%s%c",
+               YAJL_GET_STRING(severity_v), '\0');
+    }
+
+    // sev_num
+    const char *sev_num_str_path[] = {"@fields", rsyslog_field_keys[2],
+                                      (const char *)0};
+    yajl_val sev_num_str_v =
+        yajl_tree_get(*node, sev_num_str_path, yajl_t_string);
+
+    char sev_num_str[listen_buffer_size];
+    int sev_num = -1;
+
+    if (sev_num_str_v != NULL) {
+      memset(sev_num_str, '\0', listen_buffer_size);
+      snprintf(sev_num_str, listen_buffer_size, "%s%c",
+               YAJL_GET_STRING(sev_num_str_v), '\0');
+
+      sev_num = atoi(sev_num_str);
+
+      if (sev_num < 4)
+        n.severity = NOTIF_FAILURE;
+    }
+
+    // process
+    const char *process_path[] = {"@fields", rsyslog_field_keys[3],
+                                  (const char *)0};
+    yajl_val process_v = yajl_tree_get(*node, process_path, yajl_t_string);
+
+    char process[listen_buffer_size];
+
+    if (process_v != NULL) {
+      memset(process, '\0', listen_buffer_size);
+      snprintf(process, listen_buffer_size, "%s%c", YAJL_GET_STRING(process_v),
+               '\0');
+    }
+
+    // hostname
+    const char *hostname_path[] = {rsyslog_keys[1], (const char *)0};
+    yajl_val hostname_v = yajl_tree_get(*node, hostname_path, yajl_t_string);
+
+    char hostname_str[listen_buffer_size];
+
+    if (hostname_v != NULL) {
+      memset(hostname_str, '\0', listen_buffer_size);
+      snprintf(hostname_str, listen_buffer_size, "%s%c",
+               YAJL_GET_STRING(hostname_v), '\0');
+    }
+
+    gen_message_payload(
+        (msg_v != NULL ? msg : NULL), (severity_v != NULL ? severity : NULL),
+        (sev_num_str_v != NULL ? sev_num : -1),
+        (process_v != NULL ? process : NULL),
+        (hostname_v != NULL ? hostname_str : hostname_g), timestamp, &buf);
+  } else {
+    // Data was not sent in JSON format, so just treat the whole log entry
+    // as the message (and we'll be unable to acquire certain data, so the
+    // payload
+    // generated below will be less informative)
+
+    gen_message_payload(message, NULL, -1, NULL, hostname_g, timestamp, &buf);
+  }
+#else
+  gen_message_payload(message, NULL, -1, NULL, hostname_g, timestamp, &buf);
+#endif
+
+  sstrncpy(n.host, hostname_g, sizeof(n.host));
+
+  int status = plugin_notification_meta_add_string(&n, "ves", buf);
+
+  if (status < 0) {
+    sfree(buf);
+    ERROR("sysevent plugin: unable to set notification VES metadata: %s",
+          STRERRNO);
+    return;
+  }
+
+  DEBUG("sysevent plugin: notification VES metadata: %s",
+        n.meta->nm_value.nm_string);
+
+  DEBUG("sysevent plugin: dispatching message");
+
+  plugin_dispatch_notification(&n);
+  plugin_notification_meta_free(n.meta);
+
+  // strdup'd in gen_message_payload
+  if (buf != NULL)
+    sfree(buf);
+}
+
+static void read_ring_buffer() {
+  pthread_mutex_lock(&sysevent_data_lock);
+
+  // If there's currently nothing to read from the buffer,
+  // then wait
+  if (ring.head == ring.tail)
+    pthread_cond_wait(&sysevent_cond, &sysevent_data_lock);
+
+  while (ring.head != ring.tail) {
+    int next = ring.tail + 1;
+
+    if (next >= ring.maxLen)
+      next = 0;
+
+    DEBUG("sysevent plugin: reading from ring buffer: %s",
+          ring.buffer[ring.tail]);
+
+    cdtime_t timestamp = ring.timestamp[ring.tail];
+    char *match_str = NULL;
+
+#if HAVE_YAJL_V2
+    // Try to parse JSON, and if it fails, fall back to plain string
+    char errbuf[1024];
+    errbuf[0] = 0;
+    yajl_val node = yajl_tree_parse((const char *)ring.buffer[ring.tail],
+                                    errbuf, sizeof(errbuf));
+
+    if (node != NULL) {
+      // JSON rsyslog data
+
+      // If we have any regex filters, we need to see if the message portion of
+      // the data matches any of them (otherwise we're not interested)
+      if (monitor_all_messages == 0) {
+        const char *path[] = {"@message", (const char *)0};
+        yajl_val v = yajl_tree_get(node, path, yajl_t_string);
+
+        char json_val[listen_buffer_size];
+        memset(json_val, '\0', listen_buffer_size);
+
+        snprintf(json_val, listen_buffer_size, "%s%c", YAJL_GET_STRING(v),
+                 '\0');
+
+        match_str = (char *)&json_val;
       }
+    } else {
+      // non-JSON rsyslog data
 
-      pthread_mutex_unlock(&sysevent_lock);
+      // If we have any regex filters, we need to see if the message data
+      // matches any of them (otherwise we're not interested)
+      if (monitor_all_messages == 0)
+        match_str = ring.buffer[ring.tail];
     }
+#else
+    // If we have any regex filters, we need to see if the message data
+    // matches any of them (otherwise we're not interested)
+    if (monitor_all_messages == 0)
+      match_str = ring.buffer[ring.tail];
+#endif
 
-    usleep(1000);
+    int is_match = 1;
 
-    pthread_mutex_lock(&sysevent_lock);
+    // If we care about matching, do that comparison here
+    if (match_str != NULL) {
+      if (ignorelist_match(ignorelist, match_str) != 0)
+        is_match = 0;
+      else
+        DEBUG("sysevent plugin: regex filter match");
+    }
+
+#if HAVE_YAJL_V2
+    if (is_match == 1 && node != NULL) {
+      sysevent_dispatch_notification(NULL, &node, timestamp);
+      yajl_tree_free(node);
+    } else if (is_match == 1)
+      sysevent_dispatch_notification(ring.buffer[ring.tail], NULL, timestamp);
+#else
+    if (is_match == 1)
+      sysevent_dispatch_notification(ring.buffer[ring.tail], timestamp);
+#endif
+
+    ring.tail = next;
+  }
+
+  pthread_mutex_unlock(&sysevent_data_lock);
+}
+
+static void *sysevent_socket_thread(void *arg) /* {{{ */
+{
+  pthread_mutex_lock(&sysevent_thread_lock);
+
+  while (sysevent_socket_thread_loop > 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
+
+    if (sock == -1)
+      return (void *)0;
+
+    int status = read_socket();
+
+    pthread_mutex_lock(&sysevent_thread_lock);
 
     if (status < 0) {
-      WARNING("sysevent plugin: problem with thread status: %d", status);
-      sysevent_thread_error = 1;
+      WARNING("sysevent plugin: problem with socket thread (status: %d)",
+              status);
+      sysevent_socket_thread_error = 1;
       break;
     }
+  } /* while (sysevent_socket_thread_loop > 0) */
 
-    if (sysevent_thread_loop <= 0)
-      break;
-  } /* while (sysevent_thread_loop > 0) */
+  pthread_mutex_unlock(&sysevent_thread_lock);
+
+  return (void *)0;
+} /* }}} void *sysevent_socket_thread */
+
+// Entry point for thread responsible for reading from
+// ring buffer and dispatching notifications
+static void *sysevent_dequeue_thread(void *arg) /* {{{ */
+{
+  pthread_mutex_lock(&sysevent_thread_lock);
+
+  while (sysevent_dequeue_thread_loop > 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
+
+    read_ring_buffer();
+
+    pthread_mutex_lock(&sysevent_thread_lock);
+  } /* while (sysevent_dequeue_thread_loop > 0) */
 
-  pthread_mutex_unlock(&sysevent_lock);
+  pthread_mutex_unlock(&sysevent_thread_lock);
 
-  // pthread_exit instead of return?
-  return ((void *)0);
-} /* }}} void *sysevent_thread */
+  return (void *)0;
+} /* }}} void *sysevent_dequeue_thread */
 
-static int start_thread(void) /* {{{ */
+static int start_socket_thread(void) /* {{{ */
 {
-  int status;
+  pthread_mutex_lock(&sysevent_thread_lock);
+
+  if (sysevent_socket_thread_loop != 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
+    return 0;
+  }
 
-  pthread_mutex_lock(&sysevent_lock);
+  sysevent_socket_thread_loop = 1;
+  sysevent_socket_thread_error = 0;
 
-  if (sysevent_thread_loop != 0) {
-    pthread_mutex_unlock(&sysevent_lock);
-    return (0);
+  DEBUG("sysevent plugin: starting socket thread");
+
+  int status = plugin_thread_create(&sysevent_socket_thread_id,
+                                    /* attr = */ NULL, sysevent_socket_thread,
+                                    /* arg = */ (void *)0, "sysevent");
+  if (status != 0) {
+    sysevent_socket_thread_loop = 0;
+    ERROR("sysevent plugin: starting socket thread failed.");
+    pthread_mutex_unlock(&sysevent_thread_lock);
+    return -1;
   }
 
-  sysevent_thread_loop = 1;
-  sysevent_thread_error = 0;
+  pthread_mutex_unlock(&sysevent_thread_lock);
+
+  return 0;
+} /* }}} int start_socket_thread */
+
+static int start_dequeue_thread(void) /* {{{ */
+{
+  pthread_mutex_lock(&sysevent_thread_lock);
+
+  if (sysevent_dequeue_thread_loop != 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
+    return 0;
+  }
 
-  DEBUG("sysevent plugin: starting thread");
+  sysevent_dequeue_thread_loop = 1;
 
-  status = plugin_thread_create(&sysevent_thread_id, /* attr = */ NULL,
-                                sysevent_thread,
-                                /* arg = */ (void *)0, "sysevent");
+  int status = plugin_thread_create(&sysevent_dequeue_thread_id,
+                                    /* attr = */ NULL, sysevent_dequeue_thread,
+                                    /* arg = */ (void *)0, "ssyevent");
   if (status != 0) {
-    sysevent_thread_loop = 0;
-    ERROR("sysevent plugin: starting thread failed.");
-    pthread_mutex_unlock(&sysevent_lock);
-    return (-1);
+    sysevent_dequeue_thread_loop = 0;
+    ERROR("sysevent plugin: Starting dequeue thread failed.");
+    pthread_mutex_unlock(&sysevent_thread_lock);
+    return -1;
   }
 
-  pthread_mutex_unlock(&sysevent_lock);
-  return (0);
-} /* }}} int start_thread */
+  pthread_mutex_unlock(&sysevent_thread_lock);
 
-static int stop_thread(int shutdown) /* {{{ */
+  return status;
+} /* }}} int start_dequeue_thread */
+
+static int start_threads(void) /* {{{ */
 {
-  int status;
+  int status = start_socket_thread();
+  int status2 = start_dequeue_thread();
 
-  pthread_mutex_lock(&sysevent_lock);
+  if (status != 0)
+    return status;
+  else
+    return status2;
+} /* }}} int start_threads */
+
+static int stop_socket_thread(int shutdown) /* {{{ */
+{
+  pthread_mutex_lock(&sysevent_thread_lock);
 
-  if (sysevent_thread_loop == 0) {
-    pthread_mutex_unlock(&sysevent_lock);
-    return (-1);
+  if (sysevent_socket_thread_loop == 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
+    return -1;
   }
 
-  sysevent_thread_loop = 0;
-  pthread_mutex_unlock(&sysevent_lock);
+  sysevent_socket_thread_loop = 0;
+  pthread_cond_broadcast(&sysevent_cond);
+  pthread_mutex_unlock(&sysevent_thread_lock);
+
+  int status;
 
   if (shutdown == 1) {
     // Since the thread is blocking, calling pthread_join
     // doesn't actually succeed in stopping it.  It will stick around
     // until a message is received on the socket (at which
-    // it will realize that "sysevent_thread_loop" is 0 and will
+    // it will realize that "sysevent_socket_thread_loop" is 0 and will
     // break out of the read loop and be allowed to die).  This is
     // fine when the process isn't supposed to be exiting, but in
     // the case of a process shutdown, we don't want to have an
@@ -544,84 +833,137 @@ static int stop_thread(int shutdown) /* {{{ */
     // the case of a shutdown is just assures that the thread is
     // gone and that the process has been fully terminated.
 
-    DEBUG("sysevent plugin: Canceling thread for process shutdown");
+    DEBUG("sysevent plugin: Canceling socket thread for process shutdown");
 
-    status = pthread_cancel(sysevent_thread_id);
+    status = pthread_cancel(sysevent_socket_thread_id);
 
-    if (status != 0) {
-      ERROR("sysevent plugin: Unable to cancel thread: %d (%s)", status,
-            strerror(errno));
+    if (status != 0 && status != ESRCH) {
+      ERROR("sysevent plugin: Unable to cancel socket thread: %d (%s)", status,
+            STRERRNO);
       status = -1;
-    }
+    } else
+      status = 0;
   } else {
-    status = pthread_join(sysevent_thread_id, /* return = */ NULL);
-    if (status != 0) {
-      ERROR("sysevent plugin: Stopping thread failed.");
+    status = pthread_join(sysevent_socket_thread_id, /* return = */ NULL);
+    if (status != 0 && status != ESRCH) {
+      ERROR("sysevent plugin: Stopping socket thread failed.");
       status = -1;
-    }
+    } else
+      status = 0;
+  }
+
+  pthread_mutex_lock(&sysevent_thread_lock);
+  memset(&sysevent_socket_thread_id, 0, sizeof(sysevent_socket_thread_id));
+  sysevent_socket_thread_error = 0;
+  pthread_mutex_unlock(&sysevent_thread_lock);
+
+  DEBUG("sysevent plugin: Finished requesting stop of socket thread");
+
+  return status;
+} /* }}} int stop_socket_thread */
+
+static int stop_dequeue_thread() /* {{{ */
+{
+  pthread_mutex_lock(&sysevent_thread_lock);
+
+  if (sysevent_dequeue_thread_loop == 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
+    return -1;
   }
 
-  pthread_mutex_lock(&sysevent_lock);
-  memset(&sysevent_thread_id, 0, sizeof(sysevent_thread_id));
-  sysevent_thread_error = 0;
-  pthread_mutex_unlock(&sysevent_lock);
+  sysevent_dequeue_thread_loop = 0;
+  pthread_cond_broadcast(&sysevent_cond);
+  pthread_mutex_unlock(&sysevent_thread_lock);
+
+  // Since the thread is blocking, calling pthread_join
+  // doesn't actually succeed in stopping it.  It will stick around
+  // until a message is received on the socket (at which
+  // it will realize that "sysevent_dequeue_thread_loop" is 0 and will
+  // break out of the read loop and be allowed to die).  Since this
+  // function is called when the processing is exiting, we don't want to
+  // have an idle thread hanging around.  Calling pthread_cancel here
+  // just assures that the thread is gone and that the process has been
+  // fully terminated.
+
+  DEBUG("sysevent plugin: Canceling dequeue thread for process shutdown");
+
+  int status = pthread_cancel(sysevent_dequeue_thread_id);
+
+  if (status != 0 && status != ESRCH) {
+    ERROR("sysevent plugin: Unable to cancel dequeue thread: %d (%s)", status,
+          STRERRNO);
+    status = -1;
+  } else
+    status = 0;
 
-  DEBUG("sysevent plugin: Finished requesting stop of thread");
+  pthread_mutex_lock(&sysevent_thread_lock);
+  memset(&sysevent_dequeue_thread_id, 0, sizeof(sysevent_dequeue_thread_id));
+  pthread_mutex_unlock(&sysevent_thread_lock);
 
-  return (status);
-} /* }}} int stop_thread */
+  DEBUG("sysevent plugin: Finished requesting stop of dequeue thread");
+
+  return status;
+} /* }}} int stop_dequeue_thread */
+
+static int stop_threads() /* {{{ */
+{
+  int status = stop_socket_thread(1);
+  int status2 = stop_dequeue_thread();
+
+  if (status != 0)
+    return status;
+  else
+    return status2;
+} /* }}} int stop_threads */
 
 static int sysevent_init(void) /* {{{ */
 {
   ring.head = 0;
   ring.tail = 0;
   ring.maxLen = buffer_length;
-  ring.buffer = (char **)malloc(buffer_length * sizeof(char *));
+  ring.buffer = (char **)calloc(buffer_length, sizeof(char *));
 
-  if (ring.buffer == NULL)
-  {
-    ERROR("sysevent plugin: sysevent_init malloc failed");
-    return (-1);
+  if (ring.buffer == NULL) {
+    ERROR("sysevent plugin: sysevent_init calloc failed");
+    return -1;
   }
 
   for (int i = 0; i < buffer_length; i++) {
-    ring.buffer[i] = malloc(listen_buffer_size);
+    ring.buffer[i] = calloc(1, listen_buffer_size);
   }
 
-  ring.timestamp = (long long unsigned int *)malloc(
-      buffer_length * sizeof(long long unsigned int));
+  ring.timestamp = (cdtime_t *)calloc(buffer_length, sizeof(cdtime_t));
 
   if (sock == -1) {
-    const char *hostname = listen_ip;
-    const char *portname = listen_port;
-    struct addrinfo hints;
-    memset(&hints, 0, sizeof(hints));
-    hints.ai_family = AF_UNSPEC;
-    hints.ai_socktype = SOCK_DGRAM;
-    hints.ai_protocol = 0;
-    hints.ai_flags = AI_PASSIVE | AI_ADDRCONFIG;
+    struct addrinfo hints = {
+        .ai_family = AF_UNSPEC,
+        .ai_socktype = SOCK_DGRAM,
+        .ai_protocol = 0,
+        .ai_flags = AI_PASSIVE | AI_ADDRCONFIG,
+    };
     struct addrinfo *res = 0;
 
-    int err = getaddrinfo(hostname, portname, &hints, &res);
+    int err = getaddrinfo(listen_ip, listen_port, &hints, &res);
 
     if (err != 0) {
       ERROR("sysevent plugin: failed to resolve local socket address (err=%d)",
             err);
       freeaddrinfo(res);
-      return (-1);
+      return -1;
     }
 
     sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
     if (sock == -1) {
-      ERROR("sysevent plugin: failed to open socket: %s", strerror(errno));
+      ERROR("sysevent plugin: failed to open socket: %s", STRERRNO);
       freeaddrinfo(res);
-      return (-1);
+      return -1;
     }
 
     if (bind(sock, res->ai_addr, res->ai_addrlen) == -1) {
-      ERROR("sysevent plugin: failed to bind socket: %s", strerror(errno));
+      ERROR("sysevent plugin: failed to bind socket: %s", STRERRNO);
       freeaddrinfo(res);
-      return (-1);
+      sock = -1;
+      return -1;
     }
 
     freeaddrinfo(res);
@@ -629,7 +971,7 @@ static int sysevent_init(void) /* {{{ */
 
   DEBUG("sysevent plugin: socket created and bound");
 
-  return (start_thread());
+  return start_threads();
 } /* }}} int sysevent_init */
 
 static int sysevent_config_add_listen(const oconfig_item_t *ci) /* {{{ */
@@ -639,13 +981,13 @@ static int sysevent_config_add_listen(const oconfig_item_t *ci) /* {{{ */
     ERROR("sysevent plugin: The `%s' config option needs "
           "two string arguments (ip and port).",
           ci->key);
-    return (-1);
+    return -1;
   }
 
   listen_ip = strdup(ci->values[0].value.string);
   listen_port = strdup(ci->values[1].value.string);
 
-  return (0);
+  return 0;
 }
 
 static int sysevent_config_add_buffer_size(const oconfig_item_t *ci) /* {{{ */
@@ -653,16 +995,16 @@ static int sysevent_config_add_buffer_size(const oconfig_item_t *ci) /* {{{ */
   int tmp = 0;
 
   if (cf_util_get_int(ci, &tmp) != 0)
-    return (-1);
+    return -1;
   else if ((tmp >= 1024) && (tmp <= 65535))
     listen_buffer_size = tmp;
   else {
     WARNING(
         "sysevent plugin: The `BufferSize' must be between 1024 and 65535.");
-    return (-1);
+    return -1;
   }
 
-  return (0);
+  return 0;
 }
 
 static int sysevent_config_add_buffer_length(const oconfig_item_t *ci) /* {{{ */
@@ -670,15 +1012,15 @@ static int sysevent_config_add_buffer_length(const oconfig_item_t *ci) /* {{{ */
   int tmp = 0;
 
   if (cf_util_get_int(ci, &tmp) != 0)
-    return (-1);
+    return -1;
   else if ((tmp >= 3) && (tmp <= 4096))
     buffer_length = tmp;
   else {
     WARNING("sysevent plugin: The `Bufferlength' must be between 3 and 4096.");
-    return (-1);
+    return -1;
   }
 
-  return (0);
+  return 0;
 }
 
 static int sysevent_config_add_regex_filter(const oconfig_item_t *ci) /* {{{ */
@@ -687,7 +1029,7 @@ static int sysevent_config_add_regex_filter(const oconfig_item_t *ci) /* {{{ */
     ERROR("sysevent plugin: The `%s' config option needs "
           "one string argument, a regular expression.",
           ci->key);
-    return (-1);
+    return -1;
   }
 
 #if HAVE_REGEX_H
@@ -699,7 +1041,7 @@ static int sysevent_config_add_regex_filter(const oconfig_item_t *ci) /* {{{ */
   if (status != 0) {
     ERROR("sysevent plugin: invalid regular expression: %s",
           ci->values[0].value.string);
-    return (1);
+    return 1;
   }
 
   monitor_all_messages = 0;
@@ -708,7 +1050,7 @@ static int sysevent_config_add_regex_filter(const oconfig_item_t *ci) /* {{{ */
           "for the \"RegexFilter\" option.");
 #endif
 
-  return (0);
+  return 0;
 }
 
 static int sysevent_config(oconfig_item_t *ci) /* {{{ */
@@ -729,250 +1071,47 @@ static int sysevent_config(oconfig_item_t *ci) /* {{{ */
     }
   }
 
-  return (0);
+  return 0;
 } /* }}} int sysevent_config */
 
-static void sysevent_dispatch_notification(const char *message,
-#if HAVE_YAJL_V2
-                                           yajl_val *node,
-#endif
-                                           long long unsigned int timestamp) {
-  char *buf = NULL;
-  notification_t n = {NOTIF_OKAY, cdtime(), "", "",  "sysevent",
-                      "",         "",       "", NULL};
-
-#if HAVE_YAJL_V2
-  if (node != NULL) {
-    // If we have a parsed-JSON node to work with, use that
-
-    char process[listen_buffer_size];
-    char severity[listen_buffer_size];
-    char sev_num_str[listen_buffer_size];
-    char msg[listen_buffer_size];
-    char hostname_str[listen_buffer_size];
-    int sev_num = -1;
-
-    // msg
-    const char *msg_path[] = {rsyslog_keys[2], (const char *)0};
-    yajl_val msg_v = yajl_tree_get(*node, msg_path, yajl_t_string);
-
-    if (msg_v != NULL) {
-      memset(msg, '\0', listen_buffer_size);
-      snprintf(msg, listen_buffer_size, "%s%c", YAJL_GET_STRING(msg_v), '\0');
-    }
-
-    // severity
-    const char *severity_path[] = {"@fields", rsyslog_field_keys[1],
-                                   (const char *)0};
-    yajl_val severity_v = yajl_tree_get(*node, severity_path, yajl_t_string);
-
-    if (severity_v != NULL) {
-      memset(severity, '\0', listen_buffer_size);
-      snprintf(severity, listen_buffer_size, "%s%c",
-               YAJL_GET_STRING(severity_v), '\0');
-    }
-
-    // sev_num
-    const char *sev_num_str_path[] = {"@fields", rsyslog_field_keys[2],
-                                      (const char *)0};
-    yajl_val sev_num_str_v =
-        yajl_tree_get(*node, sev_num_str_path, yajl_t_string);
-
-    if (sev_num_str_v != NULL) {
-      memset(sev_num_str, '\0', listen_buffer_size);
-      snprintf(sev_num_str, listen_buffer_size, "%s%c",
-               YAJL_GET_STRING(sev_num_str_v), '\0');
-
-      sev_num = atoi(sev_num_str);
-
-      if (sev_num < 4)
-        n.severity = NOTIF_FAILURE;
-    }
-
-    // process
-    const char *process_path[] = {"@fields", rsyslog_field_keys[3],
-                                  (const char *)0};
-    yajl_val process_v = yajl_tree_get(*node, process_path, yajl_t_string);
-
-    if (process_v != NULL) {
-      memset(process, '\0', listen_buffer_size);
-      snprintf(process, listen_buffer_size, "%s%c", YAJL_GET_STRING(process_v),
-               '\0');
-    }
-
-    // hostname
-    const char *hostname_path[] = {rsyslog_keys[1], (const char *)0};
-    yajl_val hostname_v = yajl_tree_get(*node, hostname_path, yajl_t_string);
-
-    if (hostname_v != NULL) {
-      memset(hostname_str, '\0', listen_buffer_size);
-      snprintf(hostname_str, listen_buffer_size, "%s%c",
-               YAJL_GET_STRING(hostname_v), '\0');
-    }
-
-    gen_message_payload(
-        (msg_v != NULL ? msg : NULL), (severity_v != NULL ? severity : NULL),
-        (sev_num_str_v != NULL ? sev_num : -1),
-        (process_v != NULL ? process : NULL),
-        (hostname_v != NULL ? hostname_str : hostname_g), timestamp, &buf);
-  } else {
-    // Data was not sent in JSON format, so just treat the whole log entry
-    // as the message (and we'll be unable to acquire certain data, so the
-    // payload
-    // generated below will be less informative)
-
-    gen_message_payload(message, NULL, -1, NULL, hostname_g, timestamp, &buf);
-  }
-#else
-  gen_message_payload(message, NULL, -1, NULL, hostname_g, timestamp, &buf);
-#endif
-
-  sstrncpy(n.host, hostname_g, sizeof(n.host));
-  sstrncpy(n.type, "gauge", sizeof(n.type));
-
-  notification_meta_t *m = calloc(1, sizeof(*m));
-
-  if (m == NULL) {
-    char errbuf[1024];
-    sfree(buf);
-    ERROR("sysevent plugin: unable to allocate metadata: %s",
-          sstrerror(errno, errbuf, sizeof(errbuf)));
-    return;
-  }
-
-  sstrncpy(m->name, "ves", sizeof(m->name));
-  m->nm_value.nm_string = sstrdup(buf);
-  m->type = NM_TYPE_STRING;
-  n.meta = m;
-
-  DEBUG("sysevent plugin: notification message: %s",
-        n.meta->nm_value.nm_string);
-
-  DEBUG("sysevent plugin: dispatching message");
-
-  plugin_dispatch_notification(&n);
-  plugin_notification_meta_free(n.meta);
-
-  // malloc'd in gen_message_payload
-  if (buf != NULL)
-    sfree(buf);
-}
-
 static int sysevent_read(void) /* {{{ */
 {
-  if (sysevent_thread_error != 0) {
-    ERROR("sysevent plugin: The sysevent thread had a problem (%d). Restarting "
-          "it.",
-          sysevent_thread_error);
+  pthread_mutex_lock(&sysevent_thread_lock);
 
-    stop_thread(0);
+  if (sysevent_socket_thread_error != 0) {
+    pthread_mutex_unlock(&sysevent_thread_lock);
 
-    start_thread();
+    ERROR("sysevent plugin: The sysevent socket thread had a problem (%d). "
+          "Restarting it.",
+          sysevent_socket_thread_error);
 
-    return (-1);
-  } /* if (sysevent_thread_error != 0) */
+    stop_threads();
 
-  pthread_mutex_lock(&sysevent_lock);
+    start_threads();
 
-  while (ring.head != ring.tail) {
-    long long unsigned int timestamp;
-    int is_match = 1;
-    char *match_str = NULL;
-    int next = ring.tail + 1;
+    return -1;
+  } /* if (sysevent_socket_thread_error != 0) */
 
-    if (next >= ring.maxLen)
-      next = 0;
+  pthread_mutex_unlock(&sysevent_thread_lock);
 
-    DEBUG("sysevent plugin: reading from ring buffer: %s",
-          ring.buffer[ring.tail]);
-
-    timestamp = ring.timestamp[ring.tail];
-
-#if HAVE_YAJL_V2
-    // Try to parse JSON, and if it fails, fall back to plain string
-    yajl_val node = NULL;
-    char errbuf[1024];
-    errbuf[0] = 0;
-    node = yajl_tree_parse((const char *)ring.buffer[ring.tail], errbuf,
-                           sizeof(errbuf));
-
-    if (node != NULL) {
-      // JSON rsyslog data
-
-      // If we have any regex filters, we need to see if the message portion of
-      // the data matches any of them (otherwise we're not interested)
-      if (monitor_all_messages == 0) {
-        char json_val[listen_buffer_size];
-        const char *path[] = {"@message", (const char *)0};
-        yajl_val v = yajl_tree_get(node, path, yajl_t_string);
-
-        memset(json_val, '\0', listen_buffer_size);
-
-        snprintf(json_val, listen_buffer_size, "%s%c", YAJL_GET_STRING(v),
-                 '\0');
-
-        match_str = (char *)&json_val;
-      }
-    } else {
-      // non-JSON rsyslog data
-
-      // If we have any regex filters, we need to see if the message data
-      // matches any of them (otherwise we're not interested)
-      if (monitor_all_messages == 0)
-        match_str = ring.buffer[ring.tail];
-    }
-#else
-    // If we have any regex filters, we need to see if the message data
-    // matches any of them (otherwise we're not interested)
-    if (monitor_all_messages == 0)
-      match_str = ring.buffer[ring.tail];
-#endif
-
-    // If we care about matching, do that comparison here
-    if (match_str != NULL) {
-      is_match = 1;
-
-      if (ignorelist_match(ignorelist, match_str) != 0)
-        is_match = 0;
-      else
-        DEBUG("sysevent plugin: regex filter match");
-    }
-
-#if HAVE_YAJL_V2
-    if (is_match == 1 && node != NULL) {
-      sysevent_dispatch_notification(NULL, &node, timestamp);
-      yajl_tree_free(node);
-    } else if (is_match == 1)
-      sysevent_dispatch_notification(ring.buffer[ring.tail], NULL, timestamp);
-#else
-    if (is_match == 1)
-      sysevent_dispatch_notification(ring.buffer[ring.tail], timestamp);
-#endif
-
-    ring.tail = next;
-  }
-
-  pthread_mutex_unlock(&sysevent_lock);
-
-  return (0);
+  return 0;
 } /* }}} int sysevent_read */
 
 static int sysevent_shutdown(void) /* {{{ */
 {
-  int status;
-
   DEBUG("sysevent plugin: Shutting down thread.");
-  if (stop_thread(1) < 0)
-    return (-1);
+
+  int status = stop_threads();
+  int status2 = 0;
 
   if (sock != -1) {
-    status = close(sock);
-    if (status != 0) {
+    status2 = close(sock);
+    if (status2 != 0) {
       ERROR("sysevent plugin: failed to close socket %d: %d (%s)", sock, status,
-            strerror(errno));
-      return (-1);
-    } else
-      sock = -1;
+            STRERRNO);
+    }
+
+    sock = -1;
   }
 
   free(listen_ip);
@@ -985,7 +1124,10 @@ static int sysevent_shutdown(void) /* {{{ */
   free(ring.buffer);
   free(ring.timestamp);
 
-  return (0);
+  if (status != 0)
+    return status;
+  else
+    return status2;
 } /* }}} int sysevent_shutdown */
 
 void module_register(void) {