########################################################
# Please file all bug reports, patches, and feature
# requests under:
#      https://sourceforge.net/p/logwatch/_list/tickets
# and copy:
#    Stefan Jakobs <logwatch at localside.net>
# Help requests and discusion can be filed under:
#      https://sourceforge.net/p/logwatch/discussion/
########################################################

###########################################################################
# This was written and is maintained by:
#    Stefan Jakobs <logwatch at localside.net>
#
# Please send all comments, suggestions, bug reports,
#    etc, to logwatch at localside.net.
###########################################################################

###########################################################################
## Copyright (c) 2008-2013 Stefan Jakobs
## Covered under the included MIT/X-Consortium License:
##    http://www.opensource.org/licenses/mit-license.php
## All modifications and contributions by other persons to
## this script are assumed to have been donated to the
## Logwatch project and thus assume the above copyright
## and licensing terms.  If you want to make contributions
## under your own copyright or a different license this
## must be explicitly stated in the contribution an the
## Logwatch project reserves the right to not accept such
## contributions.  If you have made significant
## contributions to this script and want to claim
## copyright please contact logwatch-devel@lists.sourceforge.net.
#########################################################

#use warnings;
use strict;
# Same substitution, and for the same reason, as scripts/logwatch.pl -- see the
# comment there. This filter is a separate process, so it needs its own copy.
BEGIN {
   unless (eval { require HTML::Entities;
                  HTML::Entities->import('encode_entities'); 1 }) {
      *encode_entities = sub {
         my $str = shift;
         return $str unless defined $str;
         $str =~ s/&/&amp;/g;
         $str =~ s/</&lt;/g;
         $str =~ s/>/&gt;/g;
         $str =~ s/"/&quot;/g;
         $str =~ s/([^\n\r\t\x20-\x7e])/sprintf('&#%d;', ord($1))/ge;
         return $str;
      };
   }
}

my $Detail         = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
my $Version        = "1.4-20130219";
my $format = $ENV{'LOGWATCH_FORMAT_TYPE'} || 'other';

# initialize logwatch variables 
my $ThisLine        = "";
my %OtherList       = ();

# initialize variables which save the stats
my ($Starts,$Stops,$Reloads)       = ( 0, 0, 0);
my ($Perms,$FileOpenErrors)        = ( 0, 0);
my ($Drops, $WriteErrsSum)         = ( 0, 0);
my ($ExceedConns)                  = ( 0);
my (%PermFiles, %OpenFiles)        = ( (), ());
my (%WriteErrs, %Connections)      = ( (), ());
my (%Conns, %ConnsSum)             = ();
my (%Stats_center, %Stats_source, %Stats_dest)   = ( (), (), ());
my (%Stats_dropped, %Stats_supp, %Stats_global)  = ( (), (), ());
my (%Stats_program, %Stats_stored, %Stats_net)   = ( (), (), ());
my (%Stats_dropped_program, %Stats_supp_program) = ( (), ());
my (%Stats_dropped_net, %Stats_supp_net)         = ( (), ());
my (%Warnings, %IntErrors)                       = ( (), ());

### Parse the lines ###

while (defined($ThisLine = <STDIN>)) {
   chomp($ThisLine);

   #TD syslog-ng[2351]: New configuration initialized;
   if ( ($ThisLine =~ /^[Nn]ew configuration initialized/ ) ||
        ($ThisLine =~ /^Configuration reload finished;/ ) ||
        ($ThisLine =~ /^EOF on control channel, closing connection;/ ) ||
        ($ThisLine =~ /^(?:POLLERR|EOF) occurred while idle;/ )
   ) {
      #ignore
   }

   #TD syslog-ng[9754]: Changing permissions on special file /dev/xconsole
   elsif ($ThisLine =~ /^Changing permissions on special file ((\/[a-zA-Z0-9_]*)*)$/) {
      %PermFiles = (%PermFiles, $1 => $PermFiles{$1}+1);
      $Perms++;
   }

   #TD syslog-ng[9754]: Cannot open file /tmp/.adir/afile for writing (No such file or directory)
   elsif ($ThisLine =~ /^Cannot open file ((\/[a-zA-Z0-9_.]*)*) .*/) {
      # $1 fq file name, $2 only filename
      %OpenFiles = (%OpenFiles, $1 => $OpenFiles{$1}+1);
      $FileOpenErrors++;
   }

   #TD syslog-ng[9754]: SIGHUP received, restarting syslog-ng
   #TD syslog-ng[4027]: Configuration reload request received, reloading configuration;
   elsif ($ThisLine =~ /^SIGHUP received, restarting syslog-ng$/ ||
      $ThisLine =~ /^Configuration reload request received, reloading configuration;/) {
      $Reloads++;
   }

   #TD syslog-ng[9754]: syslog-ng version 1.6.2 starting
   #TD syslog-ng[3956]: syslog-ng starting up; version='2.0.9'
   elsif ($ThisLine =~ /^syslog-ng version [\d.]+ starting$/ ||
      $ThisLine =~ /^syslog-ng starting up; version='[\d.]+'$/) {
      $Starts++;
   }

   #TD syslog-ng[9754]: syslog-ng version 1.6.2 going down
   #TD syslog-ng[20043]: syslog-ng shutting down; version='2.0.9'
   elsif ($ThisLine =~ /^syslog-ng version [\d.]+ going down$/ ||
      $ThisLine =~ /^syslog-ng shutting down; version='[\d.]+'$/) {
      $Stops++;
   }

   #TD syslog-ng[20043]: Termination requested via signal, terminating;
   elsif ($ThisLine =~ /^Termination requested via signal, terminating;/) {
      # happens with shutdown, but it's not for extra accounting
   }

   # syslog-ng v1.X
   #TD syslog-ng[4833]: STATS: dropped 0
   elsif ($ThisLine =~ /^STATS: dropped ([0-9]*)$/) {
      if ($1 != 0) { $Drops = $Drops + $1; }
   }

   #TD syslog-ng[4833]: Syslog connection closed; fd='45', client='AF_INET(192.168.1.1:40280)', local='AF_INET(192.168.1.10:625)'
   #TD syslog-ng[4833]: Syslog connection accepted; fd='52', client='AF_INET(192.168.1.1:40280)', local='AF_INET(192.168.1.10:625)'
   # syslog-ng v3.X
   #TD Syslog connection broken; fd='63', server='AF_INET(192.169.1.1:514)', time_reopen='60' : 44 Time(s)
   #TD Syslog connection established; fd='48', server='AF_INET(192.168.1.1:514)', local='AF_INET(0.0.0.0:0)' 
   elsif ($ThisLine =~ /^Syslog connection (\S+); fd='\d+', (server|client)='AF_INET\(([.\d]+):\d+\)', (?:local='AF_INET\(([.\d]+:\d+)\)'|time_reopen='\d+')?$/) {
      my $loc = defined($4) ? $4 : '0.0.0.0';
      $Connections{"$1 ($2)"}{$loc}{$3}++;
   }

   #TD syslog-ng[4833]: Connection broken to AF_INET(XXX.YYY.ZZZ.AAA:BBB), reopening in 60 seconds
   elsif ($ThisLine =~ /^Connection broken to [A-Z_]*\((([0-9]{1,3}\.){3}[0-9]{1,3}:[0-9]{1,5})\), reopening in [0-9]* seconds$/) {
      $Conns{'Connection broken'}{$1}++;
      $ConnsSum{'Connection broken'}++;
   }

   # syslog-ng v2.X
   #TD syslog-ng[4833]: Connection failed; error='Connection timed out (110)', time_reopen='60'
   #TD syslog-ng[4833]: Connection failed; error='Connection refused (111)', time_reopen='60'
   #TD syslog-ng[4833]: Connection broken; time_reopen='60' 
   elsif ($ThisLine =~ /^(Connection \w+); (?:error='([^\(']+) \(\d+\)', )?time_reopen='\d+'/ ) {
      $Conns{$1}{$2}++;
      $ConnsSum{$1}++;
   }

   #TD syslog-ng[4869]: io.c: do_write: write() failed (errno 111), Connection refused
   #TD syslog-ng[4869]: I/O error occurred while writing; fd='66', error='Connection refused (111)'
   elsif ( ($ThisLine =~ /^io\.c: do_write: write\(\) failed \(errno ([\d]+)\)/) or 
           ($ThisLine =~ /I\/O error occurred while writing; fd='\d+', error='[^'(]+ \((\d+)\)'/) 
   ) {
      $WriteErrs{$1}++;
      $WriteErrsSum++;
   } 

   # Log statistics from syslog-ng v2.X
   #TD syslog-ng[4883]: Log statistics; dropped='program(/path/to/p)=12', 
   #        processed='center(queued)=1717', processed='center(received)=916', ...
   #        suppressed='program(/path/to/p)=0'
   # Log statisctics from syslog-ng v3.X
   #TD syslog-ng[1625]: Log statistics; processed='destination(newsnotice)=0',
   #     processed='center(queued)=0', processed='src.internal(src#0)=7',
   #     stamp='src.internal(src#0)=1283808150', processed='global(msg_clones)=0', ...
   elsif ($ThisLine =~ /^Log statistics; /) {
      my @processed = 
         $ThisLine =~ /processed='([a-z.]*)\((\S*)\)=([0-9]*)'/g;
      for (my $i=0; $i<@processed; $i=$i+3)
      {
         if ($processed[$i] eq "center") { 
            $Stats_center{$processed[$i+1]} = 
               $Stats_center{$processed[$i+1]} + $processed[$i+2]; 
         } elsif ($processed[$i] eq "destination") {
            $Stats_dest{$processed[$i+1]} = 
               $Stats_dest{$processed[$i+1]} + $processed[$i+2];
         } elsif ($processed[$i] eq "source" || $processed[$i] eq "src.internal" ||
                  $processed[$i] eq 'src.none' || $processed[$i] eq 'src.journald') {
            $Stats_source{$processed[$i+1]} = 
               $Stats_source{$processed[$i+1]} + $processed[$i+2];
         } elsif ($processed[$i] eq "global") {
            $Stats_global{$processed[$i+1]} =
               $Stats_global{$processed[$i+1]} + $processed[$i+2];
         } elsif ($processed[$i] eq "dst.program") {
            $Stats_program{$processed[$i+1]} =
               $Stats_program{$processed[$i+1]} + $processed[$i+2];
         } elsif ($processed[$i] =~ /(?:dst\.)?(?:udp|tcp)/) {
            $Stats_net{$processed[$i+1]} =
               $Stats_net{$processed[$i+1]} + $processed[$i+2];
         } else { chomp($ThisLine); $OtherList{$ThisLine}++; }
      }
      my @dropped =
              $ThisLine =~ /dropped='([a-z.]*)\((\S*)\)=([0-9]*)'/g;
      for (my $i=0; $i<@dropped; $i=$i+3)
      {
         if ($dropped[$i] eq "program" || $dropped[$i] eq "pipe") {
            if ($dropped[$i+2] > 0) {
               $Stats_dropped{$dropped[$i+1]} =
                  $Stats_dropped{$dropped[$i+1]} + $dropped[$i+2];
            }
         } elsif ($dropped[$i] =~ /(?:dst\.)?(?:tcp|udp)/) {
            if ($dropped[$i+2] > 0) {
               $Stats_dropped_net{$dropped[$i+1]} =
                  $Stats_dropped_net{$dropped[$i+1]} + $dropped[$i+2];
            }
         } elsif ($dropped[$i] eq "dst.program") {
            if ($dropped[$i+2] > 0) {
               $Stats_dropped_program{$dropped[$i+1]} =
                  $Stats_dropped_program{$dropped[$i+1]} + $dropped[$i+2];
            }
         } else { chomp($ThisLine); $OtherList{$ThisLine}++; }
      }   
      my @suppressed =
         $ThisLine =~ /suppressed='([a-z.]*)\((\S*)\)=([0-9]*)'/g;
      for (my $i=0; $i<@suppressed; $i=$i+3)
      {
         if ($suppressed[$i] eq "program" || $suppressed[$i] eq "pipe") {
            if ($suppressed[$i+2] > 0) {
               $Stats_supp{$suppressed[$i+1]} =
                  $Stats_supp{$suppressed[$i+1]} + $suppressed[$i+2];
            }
         } elsif ($suppressed[$i] =~ /(?:dst\.)?(?:tcp|udp)/) {
            if ($suppressed[$i+2] > 0) {
               $Stats_supp_net{$suppressed[$i+1]} =
                  $Stats_supp_net{$suppressed[$i+1]} + $suppressed[$i+2];
            }
         } elsif ($suppressed[$i] eq "dst.program") {
            if ($suppressed[$i+2] > 0) {
               $Stats_supp_program{$suppressed[$i+1]} =
                  $Stats_supp_program{$suppressed[$i+1]} + $suppressed[$i+2];
            }
         } else { chomp($ThisLine); $OtherList{$ThisLine}++; }
      }
      my @stored = 
          $ThisLine =~ /stored='([a-z.]*)\((\S*)\)=([0-9]*)'/g;
      for (my $i=0; $i<@stored; $i=$i+3)
      {
         if ($stored[$i] =~ "(?:dst\.)?(?:program|tcp|udp)" || $stored[$i] eq "pipe") {
            if ($stored[$i+2] > 0) {
               $Stats_stored{$stored[$i+1]} =
                  $Stats_stored{$stored[$i+1]} + $stored[$i+2];
            }
         } else { chomp($ThisLine); $OtherList{$ThisLine}++; }
      }
   }

   # syslog-ng v2.X
   #TD syslog-ng[1796]: Number of allowed concurrent connections exceeded; num='10', max='10'  
   elsif ($ThisLine =~ /^Number of allowed concurrent connections exceeded/) {
      $ExceedConns++;
   }

   # syslog-ng v3.X
   #TD syslog-ng[1601]: WARNING: global: the default value of chain_hostnames is changing to
   #     'no' in version 3.0, please update your configuration accordingly;
   #TD syslog-ng[1601]: WARNING: you are using the pipe driver, underlying file is not a
   #     FIFO, it should be used by file(); filename='/dev/tty10'
   elsif ($ThisLine =~ /^WARNING: (.*)$/) {
      $Warnings{$1}++;
   }
   # syslog-ng v3.X
   #TD syslog-ng[1601]: Configuration file has no version number, assuming ...
   elsif ($ThisLine =~ /(Configuration file has no version number)/) {
      $Warnings{$1}++;
   }

   # syslog-ng v2.X
   #TD syslog-ng[1602]: Error initializing new configuration, reverting to old config;
   elsif ($ThisLine =~ /^Error initializing new configuration, reverting to old config;/) {
      $IntErrors{"Error initializing new configuration"}{"reverting to old config"}++;
   }

   #TD syslog-ng[2550]: Internal error, duplicate configuration elements refer to
   #   the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
   elsif ($ThisLine =~ /Internal error, ([^;]*); name='([^']*)'/) {
      $IntErrors{$1}{$2}++;
   }

   # syslog-ng v2.X
   #TD syslog-ng[20709]: Referenced filter rule not found; rule='f_dhcpd'
   elsif ($ThisLine =~ /(Referenced filter rule not found); (.+)/) {
      $IntErrors{$1}{$2}++
   }

   # syslog-ng v2.X
   #TD syslog-ng[2000]: Error in configuration, unresolved filter reference; filter='f_host_dhcp_dns0'
   elsif ($ThisLine =~ /^Error in configuration, ([^;]+); (.+)/) {
      $IntErrors{$1}{$2}++;
   }

   else {
      # Report any unmatched entries...
      chomp($ThisLine);
      $OtherList{$ThisLine}++;
   }
}

sub outCount {
   my ($msg, $count, $category, $subcat) = @_;
   if ($format ne 'xml') {
      print $msg;
   } else {
      print "<syslog-ng:Count";
      print " count='$count'";
      #print " msg='", encode_entities($msg),"'" if $msg;
      print " cat='", encode_entities($category),"'" if $category;
      print " subcat='", encode_entities($subcat),"'" if $subcat;
      print "/>\n";
   }
}
### generate the output ###

if ($format eq 'xml') {
   # todo, embargo the output until the first actual output..
   print "<?xml version='1.0' encoding='UTF-8' ?>\n";
   print "<syslog-ng:LogwatchReport xmlns:syslog-ng='http://sourceforge.net/projects/logwatch/services/syslog-ng/20221002'>\n";
}

if (($Starts || $Stops || $Reloads) && $Detail) {
   print "<syslog-ng:Service>\n" if $format eq 'xml';
}

if ($Starts && $Detail) {
    outCount(sprintf("\n%-48s %5i Time(s)", "Syslog-ng started:", $Starts), $Starts, "Service", "started");
}

if ($Stops && $Detail) {
    outCount(sprintf("\n%-48s %5i Time(s)", "Syslog-ng stopped:", $Stops), $Stops, "Service", "stopped");
}

if ($Reloads && $Detail) {
    outCount(sprintf("\n%-48s %5i Time(s)", "Syslog-ng reloaded:", $Reloads), $Reloads, "Service", "reloaded");
}
if (($Starts || $Stops || $Reloads) && $Detail) {
   print "</syslog-ng:Service>" if $format eq 'xml';
   print "\n";
}

if ($Perms) {
    print "<syslog-ng:perms>\n" if $format eq 'xml';
    if ($Detail >= 5) {
        print "\nSyslog-ng changed the permission on the file(s):" unless $format eq 'xml';
        foreach my $file (keys %PermFiles) {
             outCount(sprintf("\n\t%-41s %5i Time(s)", $file, $PermFiles{$file}), $PermFiles{$file}, 'Perms', $file);
        }
        print "\n";
    } else {
        outCount(sprintf("\n%-48s %5i Time(s)\n", "Syslog-ng changed permission on file(s):", $Perms), $Perms, 'Perms');
    }
    print "</syslog-ng:perms>\n" if $format eq 'xml';
}

if ($FileOpenErrors) {
    print "<syslog-ng:FileOpenErrors>\n" if $format eq 'xml';
    if ($Detail >= 5) {
        print "\nSyslog-ng could not open the file(s):" unless $format eq 'xml';
        foreach my $file (keys %OpenFiles) {
            outCount(sprintf("\n\t%-41s %5i Time(s)", $file, $OpenFiles{$file}),$OpenFiles{$file},'FileOpenErrors',$file);
        }
        print "\n";
    } else {
        outCount(sprintf("\n%-48s %5i Time(s)\n", "Syslog-ng could not open file:", $FileOpenErrors),$FileOpenErrors,'FileOpenErrors');
    }
    print "</syslog-ng:FileOpenErrors>\n" if $format eq 'xml';
}

if (keys %Conns) {
    print "<syslog-ng:Connections>\n" if $format eq 'xml';
    foreach my $cat (keys %Conns) {
        print "<syslog-ng:Connection cat='", encode_entities($cat), "'>\n" if $format eq 'xml';
        if ($Detail >= 5) {
            print "\n$cat:" unless $format eq 'xml';
            foreach my $IP (keys %{$Conns{$cat}}) {
                outCount(sprintf("\n\t%-41s %5i Time(s)", $IP, $Conns{$cat}{$IP}),$Conns{$cat}{$IP},$cat,$IP);
            }
            print "\n";
        } else {
            outCount(sprintf("\n%-48s %5i Time(s)\n", "$cat:", $ConnsSum{$cat}),$ConnsSum{$cat},$cat);
        }
        print "</syslog-ng:Connection>\n" if $format eq 'xml';
    }
    print "</syslog-ng:Connections>\n" if $format eq 'xml';
}

if (keys %WriteErrs) {
    print "<syslog-ng:WriteErrors>\n" if $format eq 'xml';
    if ($Detail >= 5) {
        print "\nWrite Error(s):" unless $format eq 'xml';
        foreach my $err (keys %WriteErrs) {
            outCount(sprintf("\n\t%-41s %5i Time(s)", "Error Number $err:", $WriteErrs{$err}),$WriteErrs{$err},'WriteErrors',$err);
        }
        print "\n";
    } else {
        outCount(sprintf("\n%-48s %5i Time(s)\n", "Write Error(s):", $WriteErrsSum),$WriteErrsSum,'WriteErrors');
    }
    print "</syslog-ng:WriteErrors>\n" if $format eq 'xml';
}

if ($ExceedConns && $Detail >= 5) {
    print "<syslog-ng:ExceedConnections>\n" if $format eq 'xml';
    outCount(sprintf("\n%-48s %5i Time(s)\n", "Concurrent Connections Exceeded:", $ExceedConns),$ExceedConns,'ExceedConns');
    print "</syslog-ng:ExceedConnections>\n" if $format eq 'xml';
}

if (keys %Stats_center || keys %Stats_dest || keys %Stats_source ||
    keys %Stats_dropped || keys %Stats_supp || keys %Stats_global ||
    keys %Stats_stored || keys %Stats_program || keys %Stats_net) {
   my ($lost_rcvd, $lost_dest) = ( 0, 0);
   print '<syslog-ng:LogStatistics>' if $format eq 'xml';

   if ($Stats_center{received} && %Stats_source) {
      $lost_rcvd = 0 - $Stats_center{received};
      map {
         # skip 'src#X' as this seams to be aggregated into 'src'
         # skip 'journal' as this is not counted.
         $lost_rcvd = $lost_rcvd + $Stats_source{$_} unless ($_ =~ /(?:src#\d+|journal)/);
      } keys %Stats_source;
   }
   if ($Stats_center{queued} && %Stats_dest) {
      $lost_dest = $Stats_center{queued};
      map { $lost_dest = $lost_dest - $Stats_dest{$_} } keys %Stats_dest;
   }

   if ($Detail >= 6 and $format ne 'xml') { print "\nLog Statistics:"; }
   if ($lost_rcvd != 0 || $lost_dest != 0) {
      if ($lost_rcvd != 0) { 
         if ($Detail >= 5) { 
            outCount("\n- Failed to receive $lost_rcvd message(s)!",$lost_rcvd,'Log Statistics','Failed to receive messages');
         }
      }
      if ($lost_dest != 0) {
         if ($Detail >= 5 ) {
            outCount("\n- Failed to save $lost_dest message(s) in logfile(s)!",$lost_dest,'Log Statistics','Failed to save messages');
         } else { $Drops = $Drops +  $lost_dest; }
      }
      if ($Detail >= 5) { print "\n"; }
   }

   if ($Detail >= 6) {
      if (keys %Stats_center) {
         print "\nCenter:" unless $format eq 'xml';
         foreach my $center (sort {$a cmp $b} keys %Stats_center) {
            outCount(sprintf("\n\t%-34s %12i", $center, $Stats_center{$center}), $Stats_center{$center}, "Center", $center);
         }
      }
      if (keys %Stats_dest) {
         print "\nDestination:" unless $format eq 'xml';
         foreach my $dest (sort {$a cmp $b} keys %Stats_dest) {
            outCount(sprintf("\n\t%-34s %12i", $dest, $Stats_dest{$dest}), $Stats_dest{$dest}, "Destination", $dest);
         }
      }
      if (keys %Stats_source) {
         print "\nSource:" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_source) {
            outCount(sprintf("\n\t%-34s %12i", $source, $Stats_source{$source}),$Stats_source{$source},"Source",$source);
         }
      }
      if (keys %Stats_net) {
         print "\nNetwork:" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_net) {
            (my $short_source) = ($source =~ /,?([^,]*)/); 
            outCount(sprintf("\n\t%-34s %12i", $short_source, $Stats_net{$source}),$Stats_net{$source},"Network",$short_source);
         }
      }
      if (keys %Stats_program) {
         print "\nProgram:" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_program) {
            (my $short_source) = ($source =~ /,?([^,]*)/); 
            outCount(sprintf("\n\t%-34s %12i", $short_source, $Stats_program{$source}),$Stats_program{$source},"Program",$short_source);
         }
      }
      if (keys %Stats_supp) {
         print "\nSuppressed:" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_supp) {
            outCount(sprintf("\n\t%-34s %12i", $source, $Stats_supp{$source}),$Stats_supp{$source},"Suppressed",$source);
         }
      }
      if (keys %Stats_supp_net) {
         print "\nSuppressed(net):";
         foreach my $source (sort {$a cmp $b} keys %Stats_supp_net) {
            outCount(sprintf("\n\t%-34s %12i", $source, $Stats_supp_net{$source}),$Stats_supp_net{$source},"Suppressed(net)",$source);
         }
      }
      if (keys %Stats_supp_program) {
         print "\nSuppressed(program):" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_supp_program) {
            outCount(sprintf("\n\t%-34s %12i", $source, $Stats_supp_program{$source}),$Stats_supp_program{$source},"Suppressed(program)",$source);
         }
      }
      if (keys %Stats_stored) {
         print "\nStored:" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_stored) {
            (my $short_source) = ($source =~ /,?([^,]*)/); 
            outCount(sprintf("\n\t%-34s %12i", $short_source, $Stats_stored{$source}),$Stats_stored{$source},"Stored",$short_source);
         }
      }
      if (keys %Stats_global) {
         print "\nGlobal:" unless $format eq 'xml';
         foreach my $source (sort {$a cmp $b} keys %Stats_global) {
            outCount(sprintf("\n\t%-34s %12i", $source, $Stats_global{$source}),$Stats_global{$source},"Global",$source);
         }
      }
   }
   if (keys %Stats_dropped) {
      print "\nDropped:" unless $format eq 'xml';
      foreach my $source (sort {$a cmp $b} keys %Stats_dropped) {
         outCount(sprintf("\n\t%-34s %12i", $source, $Stats_dropped{$source}),$Stats_dropped{$source},'Dropped',$source);
      }
   }
   if (keys %Stats_dropped_net) {
   print "\nDropped(net):" unless $format eq 'xml';
   foreach my $source (sort {$a cmp $b} keys %Stats_dropped_net) {
         outCount(sprintf("\n\t%-34s %12i", $source, $Stats_dropped_net{$source}),$Stats_dropped_net{$source},'Dropped(net)',$source);
      }
   }
   if (keys %Stats_dropped_program) {
   print "\nDropped(program):" unless $format eq 'xml';
   foreach my $source (sort {$a cmp $b} keys %Stats_dropped_program) {
         outCount(sprintf("\n\t%-34s %12i", $source, $Stats_dropped_program{$source}),$Stats_dropped_program{$source},'Dropped(program)',$source);
      }
   }
   if (keys %Stats_center or keys %Stats_dropped or keys %Stats_dropped_net or 
       keys %Stats_dropped_program) {
      print "\n";
   }

   print '</syslog-ng:LogStatistics>' if $format eq 'xml';
}

if (keys %Connections) {
   print '<syslog-ng:ConnectionStates>' if $format eq 'xml';
   print "syslog-ng:" unless $format eq 'xml';
   foreach my $state (sort {$a cmp $b} keys %Connections) {
      my $sum = 0;
      print "<syslog-ng:ConnectionState state='",encode_entities($state),"'>" if $format eq 'xml';
      print "\nConnections $state: " unless $format eq 'xml';
      print "\n" if $Detail > 2;
      foreach my $localip (sort {$a cmp $b} keys %{$Connections{$state}}) {
         print "<syslog-ng:interface addr='",encode_entities($localip),"'>" if $Detail > 2 and $format eq 'xml';
         print "    $localip: " if $Detail > 2 and $format ne 'xml';
         print "\n" if $Detail > 5;
         my $sum_pro_ip = 0;
         foreach my $extip (sort {$a cmp $b} keys %{$Connections{$state}{$localip}}) {
            outCount("\t$extip : $Connections{$state}{$localip}{$extip} Time(s)\n", $Connections{$state}{$localip}{$extip},'Sum',$extip) if $Detail > 5;
            $sum = $sum + $Connections{$state}{$localip}{$extip};
            $sum_pro_ip = $sum_pro_ip + $Connections{$state}{$localip}{$extip};
         }
         outCount("$sum_pro_ip\n",$sum_pro_ip,'Sum') if $Detail > 2 and $Detail <= 5;
         print "</syslog-ng:interface>" if $Detail > 2 and $format eq 'xml';
      }
      outCount("$sum\n",$sum,'Sum') if $Detail <= 2;
      print '</syslog-ng:ConnectionState>' if $format eq 'xml';
   }
   print '</syslog-ng:ConnectionStates>' if $format eq 'xml';
}

if ($Drops) {
   print '<syslog-ng:Drops>' if $format eq 'xml';
   outCount("\nSyslog-ng dropped " . $Drops ." line(s)\n",$Drops,'Dropped','lines');
   print '</syslog-ng:Drops>' if $format eq 'xml';
}

if (keys %IntErrors) {
   print '<syslog-ng:InternalErrors>' if $format eq 'xml';
   print "\nInternal Errors:" unless $format eq 'xml';
   foreach my $class (sort {$a cmp $b} keys %IntErrors) {
      print "\n    $class" unless $format eq 'xml';
      print "<syslog-ng:InternalError class='",encode_entities($class),"'>" if $format eq 'xml';
      foreach my $error (sort {$a cmp $b} keys %{$IntErrors{$class}}) {
         outCount(sprintf("\n\t%-41s %5i Time(s)", "$error:", $IntErrors{$class}{$error}),$IntErrors{$class}{$error},'IntErrors',$class);
      }
   }
   print '</syslog-ng:InternalErrors>' if $format eq 'xml';
   print "\n";
}

if (keys %Warnings) {
   print '<syslog-ng:Warnings>' if $format eq 'xml';
   print "\nWarnings:" unless $format eq 'xml';
   foreach my $warning (keys %Warnings) {
      outCount(sprintf("\n\t%-41s %5i Time(s)", "$warning:", $Warnings{$warning}),$Warnings{$warning},'Warning',$warning);
   }
   print '</syslog-ng:Warnings>' if $format eq 'xml';
   print "\n";
}

if (keys %OtherList) {
   print '<syslog-ng:UnmatchedEntries>' if $format eq 'xml';
   print "\n**** Unmatched entries ****\n" unless $format eq 'xml';
   foreach my $Error (keys %OtherList) {
      outCount("    $Error : $OtherList{$Error} Time(s)\n",$OtherList{$Error},'UnmatchedEntry',$Error);
   }
   print '</syslog-ng:UnmatchedEntries>' if $format eq 'xml';
}

if ($format eq 'xml') {
   # todo, embargo the output until the first actual output..
   print "</syslog-ng:LogwatchReport>\n";
}

### return without a failure ###
exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et