From 927cdddf9cc1967f9b91b75e8783eb148df34297 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Herv=C3=A9=20COMMOWICK?= <hcommowick@exosec.fr>
Date: Wed, 10 Aug 2011 17:42:41 +0200
Subject: [PATCH] [MINOR] halog: add support for termination code matching
 (-tcn/-TCN)

It is now possible to filter by termination code with -tcn <termcode>, to be
able to track one kind of errors, for example after counting it with -tc.
Use -TCN <termcode> gives you the opposite.
---
 contrib/halog/halog.c | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/contrib/halog/halog.c b/contrib/halog/halog.c
index 120521a286..8c48d0ed5a 100644
--- a/contrib/halog/halog.c
+++ b/contrib/halog/halog.c
@@ -97,6 +97,8 @@ struct url_stat {
 			      FILT_COUNT_URL_TTOT|FILT_COUNT_URL_TAVG|FILT_COUNT_URL_TTOTO|FILT_COUNT_URL_TAVGO)
 
 #define FILT_HTTP_ONLY       0x200000
+#define FILT_TERM_CODE_NAME 0x400000
+#define FILT_INVERT_TERM_CODE_NAME 0x800000
 
 unsigned int filter = 0;
 unsigned int filter_invert = 0;
@@ -120,7 +122,8 @@ void die(const char *msg)
 	fprintf(stderr,
 		"%s"
 		"Usage: halog [-q] [-c] [-v] {-gt|-pct|-st|-tc|-srv|-u|-uc|-ue|-ua|-ut|-uao|-uto}\n"
-		"       [-s <skip>] [-e|-E] [-H] [-rt|-RT <time>] [-ad <delay>] [-ac <count>] < log\n"
+		"       [-s <skip>] [-e|-E] [-H] [-rt|-RT <time>] [-ad <delay>] [-ac <count>]\n"
+		"       [-tcn|-TCN <termcode>] < log\n"
 		"\n",
 		msg ? msg : ""
 		);
@@ -397,6 +400,7 @@ void truncated_line(int linenum, const char *line)
 int main(int argc, char **argv)
 {
 	const char *b, *e, *p, *time_field, *accept_field;
+	const char *filter_term_code_name = NULL;
 	const char *output_file = NULL;
 	int f, last, err;
 	struct timer *t = NULL;
@@ -465,6 +469,18 @@ int main(int argc, char **argv)
 			filter |= FILT_COUNT_SRV_STATUS;
 		else if (strcmp(argv[0], "-tc") == 0)
 			filter |= FILT_COUNT_TERM_CODES;
+		else if (strcmp(argv[0], "-tcn") == 0) {
+			if (argc < 2) die("missing option for -tcn");
+			argc--; argv++;
+			filter |= FILT_TERM_CODE_NAME;
+			filter_term_code_name = *argv;
+		}
+		else if (strcmp(argv[0], "-TCN") == 0) {
+			if (argc < 2) die("missing option for -TCN");
+			argc--; argv++;
+			filter |= FILT_TERM_CODE_NAME | FILT_INVERT_TERM_CODE_NAME;
+			filter_term_code_name = *argv;
+		}
 		else if (strcmp(argv[0], "-u") == 0)
 			filter |= FILT_COUNT_URL_ONLY;
 		else if (strcmp(argv[0], "-uc") == 0)
@@ -617,6 +633,22 @@ int main(int argc, char **argv)
 			}
 		}
 
+		if (filter & FILT_TERM_CODE_NAME) {
+			/* only report corresponding termination code name */
+			if (time_field)
+				b = field_start(time_field, TERM_CODES_FIELD - TIME_FIELD + 1);
+			else
+				b = field_start(accept_field, TERM_CODES_FIELD - ACCEPT_FIELD + 1);
+
+			if (unlikely(!*b)) {
+				truncated_line(linenum, line);
+				continue;
+			}
+
+			test &= (b[0] == filter_term_code_name[0] && b[1] == filter_term_code_name[1]) ^ !!(filter & FILT_INVERT_TERM_CODE_NAME);
+		}
+
+
 		test ^= filter_invert;
 		if (!test)
 			continue;