Index: trunk/src/sh_log_evalrule.c
===================================================================
--- trunk/src/sh_log_evalrule.c	(revision 185)
+++ trunk/src/sh_log_evalrule.c	(revision 186)
@@ -24,4 +24,6 @@
 #include "sh_log_evalrule.h"
 #include "zAVLTree.h"
+
+extern int flag_err_debug;
 
 /* #define DEBUG_EVALRULES */
@@ -91,4 +93,5 @@
   struct sh_geval * nextrule;        /* next rule in this group */
   struct sh_geval * next;            /* next group of rules     */
+  struct sh_geval * gnext;           /* grouplist next          */
 };
 
@@ -176,4 +179,5 @@
   ng->nextrule    = NULL;
   ng->next        = NULL;
+  ng->gnext       = NULL;
 
   if (!host_open)
@@ -199,6 +203,6 @@
 	{
 	  tmp = grouplist; 
-	  while (tmp->next != NULL) { tmp = tmp->next; }
-	  tmp->next = ng;
+	  while (tmp->gnext != NULL) { tmp = tmp->gnext; }
+	  tmp->gnext = ng;
 	} else {
 	  grouplist = ng;
@@ -319,4 +323,11 @@
     }
   
+  if (!strcmp(splits[1], _("trash"))) /* predefined, reserved */
+    {
+      SH_FREE(splits);
+      SH_FREE(new);
+      return -1;
+    }
+  
   severity = sh_error_convert_level (splits[3]);
   if (severity < 0)
@@ -364,4 +375,6 @@
   return retval;
 }
+
+static struct sh_qeval ** dummy_queue;
 
 int sh_eval_radd (const char * str)
@@ -380,4 +393,6 @@
   char **      splits = split_array(new, &nfields, ':', lengths);
 
+  dummy_queue = &queue;
+
   if (nfields != 2)
     {
@@ -419,4 +434,16 @@
   rule_extra = NULL; /* pcre_study(rule, 0, &error); */
   pcre_fullinfo(rule, rule_extra, PCRE_INFO_CAPTURECOUNT, &captures);
+
+  if (flag_err_debug == SL_TRUE)
+    {
+      char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+      sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Adding rule: |%s| with %d captures"), 
+		  splits[1], captures);
+      SH_MUTEX_LOCK(mutex_thread_nolog);
+      sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+		      emsg, _("sh_eval_radd"));
+      SH_MUTEX_UNLOCK(mutex_thread_nolog);
+      SH_FREE(emsg);
+    }
 
   DEBUG("adding rule: |%s| with %d captures\n", splits[1], captures);
@@ -436,4 +463,5 @@
   nr->nextrule    = NULL;
   nr->next        = NULL;
+  nr->gnext       = NULL;
 
   /* 
@@ -443,4 +471,18 @@
   if (group_open)
     {
+      if (flag_err_debug == SL_TRUE)
+	{
+	  char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+	  sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Adding rule to group |%s|"), 
+		      sh_string_str(group_open->label));
+	  SH_MUTEX_LOCK(mutex_thread_nolog);
+	  sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+			  emsg, _("sh_eval_radd"));
+	  SH_MUTEX_UNLOCK(mutex_thread_nolog);
+	  SH_FREE(emsg);
+	}
+
+      DEBUG("adding rule to group |%s|\n", sh_string_str(group_open->label));
+
       if (group_open->nextrule) 
 	{
@@ -474,26 +516,30 @@
 	   * Add rule as member to grouplist, to facilitate cleanup
 	   */
-#if 0
+
+	  DEBUG("adding solitary rule to grouplist\n");
+
 	  if (grouplist) 
 	    {
 	      tmp = grouplist; 
-	      while (tmp->next != NULL) { tmp = tmp->next; }
-	      tmp->next = nr;
+	      while (tmp->gnext != NULL) { tmp = tmp->gnext; }
+	      tmp->gnext = nr;
 	    } else {
 	      grouplist = nr;
 	    }
-#endif
+
 
 	  /* 
 	   * Add rule to host rulegroups
 	   */
+	  DEBUG("adding solitary rule to host rulegroups\n");
+
 	  if (host_open->rulegroups) 
 	    {
-	      /* Second, third, ... rule go to host_open->rulegroups->nextrule,
-	       * since test_rules() iterates over nextrules
+	      /* Second, third, ... rule go to host_open->rulegroups->next,
+	       * since test_grules() iterates over nextrules
 	       */
 	      tmp = host_open->rulegroups; 
-	      while (tmp->nextrule != NULL) { tmp = tmp->nextrule; }
-	      tmp->nextrule = nr;
+	      while (tmp->next != NULL) { tmp = tmp->next; }
+	      tmp->next = nr;
 	    } 
 	  else 
@@ -516,6 +562,4 @@
 void sh_eval_cleanup()
 {
-  struct sh_geval * tmp;
-
   struct sh_geval * gtmp;
   struct sh_qeval * qtmp;
@@ -525,5 +569,5 @@
     {
       gtmp      = grouplist;
-      grouplist = gtmp->next;
+      grouplist = gtmp->gnext;
 
       if (gtmp->label)      sh_string_destroy(&(gtmp->label));
@@ -534,5 +578,5 @@
       if (gtmp->ovector)
 	SH_FREE(gtmp->ovector);
-
+#if 0
       while (gtmp->nextrule)
 	{
@@ -548,5 +592,5 @@
 	  SH_FREE(tmp);
 	}
-
+#endif
       SH_FREE(gtmp);
     }
@@ -582,7 +626,12 @@
  * filled in
  */
+static struct sh_geval ** dummy1;
+
 static struct sh_geval * test_rule (struct sh_geval * rule, sh_string *msg)
 {
-  int res, count;
+  int res; 
+  volatile int count;
+
+  dummy1 = &rule;
 
   if (!rule)
@@ -593,4 +642,17 @@
       count = 1;
       do {
+
+	if (flag_err_debug == SL_TRUE)
+	  {
+	    char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+	    sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Check rule %d for |%s|"), 
+			count, sh_string_str(msg));
+	    SH_MUTEX_LOCK(mutex_thread_nolog);
+	    sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+			    emsg, _("test_rule"));
+	    SH_MUTEX_UNLOCK(mutex_thread_nolog);
+	    SH_FREE(emsg);
+	  }
+
 	DEBUG("debug: check rule %d for <%s>\n", count, msg->str);
 	res = pcre_exec(rule->rule, rule->rule_extra, 
@@ -600,6 +662,30 @@
 	  {
 	    rule->ovecnum = res;
+
+	    if (flag_err_debug == SL_TRUE)
+	      {
+		char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+		sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Rule %d matches, result = %d"), 
+			    count, res);
+		SH_MUTEX_LOCK(mutex_thread_nolog);
+		sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+				emsg, _("test_rule"));
+		SH_MUTEX_UNLOCK(mutex_thread_nolog);
+		SH_FREE(emsg);
+	      }
 	    DEBUG("debug: rule %d matches, result = %d\n", count, res);
 	    break; /* return the matching rule; ovector is filled in */
+	  }
+
+	if (flag_err_debug == SL_TRUE)
+	  {
+	    char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+	    sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Rule %d did not match"), 
+			count);
+	    SH_MUTEX_LOCK(mutex_thread_nolog);
+	    sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+			    emsg, _("test_rule"));
+	    SH_MUTEX_UNLOCK(mutex_thread_nolog);
+	    SH_FREE(emsg);
 	  }
 	DEBUG("debug: rule %d did not match\n", count);
@@ -614,26 +700,44 @@
   
 /* Test a (struct sh_geval *), which may be single rule or a group of rules,
- * against msg (if it's a group of rules, test against prefix first).
+ * against msg
  */
+static struct sh_geval ** dummy2;
+static struct sh_geval ** dummy3;
+
 static struct sh_geval * test_grules (struct sh_heval * host, 
-				      sh_string *prefix, sh_string *msg)
+				      sh_string *msg)
 {
   struct sh_geval * result = NULL;
-  struct sh_geval * rules = host->rulegroups;
-
-  if (rules && sh_string_len(prefix) < (size_t)INT_MAX)
-    {
-      DEBUG("debug: if rules\n");
+  struct sh_geval * group  = host->rulegroups;
+
+  dummy2 = &result;
+  dummy3 = &group;
+
+  if (group && sh_string_len(msg) < (size_t)INT_MAX)
+    {
+      DEBUG("debug: if group\n");
       do {
-	if(rules->label != NULL) 
+	if(group->label != NULL) 
 	  {
 	    /* this is a rule group; only groups have labels */
 
-	    DEBUG("debug: if rules->label %s\n", rules->label->str);
-	    if (pcre_exec(rules->rule, rules->rule_extra, 
-			  sh_string_str(prefix), (int) sh_string_len(prefix),
+	    if (flag_err_debug == SL_TRUE)
+	      {
+		char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+		sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Checking group |%s| of rules against |%s|"), 
+			    sh_string_str(group->label), sh_string_str(msg));
+		SH_MUTEX_LOCK(mutex_thread_nolog);
+		sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+				emsg, _("test_rule"));
+		SH_MUTEX_UNLOCK(mutex_thread_nolog);
+		SH_FREE(emsg);
+	      }
+
+	    DEBUG("debug: if group->label %s\n", sh_string_str(group->label));
+	    if (pcre_exec(group->rule, group->rule_extra,
+			  sh_string_str(msg), (int) sh_string_len(msg),
 			  0, 0, NULL, 0) >= 0)
 	      {
-		result = test_rule(rules->nextrule, msg);
+		result = test_rule(group->nextrule, msg);
 		if (result)
 		  break;
@@ -642,13 +746,26 @@
 	else
 	  {
-	    /* First rule is in host->rulegroups */
+	    /* If there is no group label, the 'group' is actually a solitary 
+	     * rule (not within any group).
+	     */
+
+	    if (flag_err_debug == SL_TRUE)
+	      {
+		char * emsg = SH_ALLOC(SH_ERRBUF_SIZE);
+		sl_snprintf(emsg,  SH_ERRBUF_SIZE, _("Checking solitary rules"));
+		SH_MUTEX_LOCK(mutex_thread_nolog);
+		sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
+				emsg, _("test_rule"));
+		SH_MUTEX_UNLOCK(mutex_thread_nolog);
+		SH_FREE(emsg);
+	      }
 
 	    DEBUG("debug: else (single rule)\n");
-	    result = test_rule(rules, msg);
+	    result = test_rule(group, msg);
 	    if (result)
 	      break;
 	  }
-	rules = rules->next; /* next group of rules */
-      } while (rules);
+	group = group->next; /* next group of rules */
+      } while (group);
     }
   return result;
@@ -658,5 +775,5 @@
  */
 static struct sh_geval * find_rule (sh_string *host, 
-				    sh_string *prefix, sh_string *msg)
+				    sh_string *msg)
 {
   struct sh_geval * result = NULL;
@@ -671,5 +788,5 @@
 	  {
 	    /* matching host, check rules/groups of rules */
-	    result = test_grules(hlist, prefix, msg);
+	    result = test_grules(hlist, msg);
 	    if (result)
 	      break;
@@ -681,12 +798,37 @@
 }
 
-static void msg_report(int severity, struct sh_logrecord * record)
-{
-  char * tmp;
-  char * msg;
-  char * ttt;
+/* copy the message and replace captured substrings with '___'
+ */
+static sh_string * replace_captures(const sh_string * message, 
+				    int * ovector, int ovecnum)
+{
+  sh_string * retval = sh_string_new_from_lchar(sh_string_str(message), 
+						sh_string_len(message));
+
+  if (ovecnum > 1)
+    {
+      retval = sh_string_replace(retval, &(ovector[2]), (ovecnum-1), "___", 3);
+    }
+  return retval;
+}
+
+static void msg_report(int severity, struct sh_geval * rule, struct sh_logrecord * record)
+{
+  char      * tmp;
+  char      * msg;
+  sh_string * mmm = NULL;
+  char      * ttt;
+
+
   SH_MUTEX_LOCK(mutex_thread_nolog);
+  if (rule) {
+    mmm = replace_captures(record->message, rule->ovector, 
+			   rule->ovecnum);
+    msg = sh_util_safe_name_keepspace (sh_string_str(mmm));
+  }
+  else {
+    msg = sh_util_safe_name_keepspace (sh_string_str(record->message));
+  }
   tmp = sh_util_safe_name (record->filename);
-  msg = sh_util_safe_name_keepspace (sh_string_str(record->message));
   ttt = sh_util_safe_name_keepspace (sh_string_str(record->timestr));
   sh_error_handle (severity, FIL__, __LINE__, 0, MSG_LOGMON_REP,
@@ -698,4 +840,6 @@
   SH_FREE(msg);
   SH_FREE(tmp);
+  if (mmm)
+    sh_string_destroy(&mmm);
   SH_MUTEX_UNLOCK(mutex_thread_nolog);
 }
@@ -705,4 +849,5 @@
   char * tmp;
   char * msg;
+
   SH_MUTEX_LOCK(mutex_thread_nolog);
   tmp = sh_util_safe_name (sh_string_str(path));
@@ -757,19 +902,4 @@
 }
 
-/* copy the message and replace captured substrings with '___'
- */
-static sh_string * replace_captures(const sh_string * message, 
-				    int * ovector, int ovecnum)
-{
-  sh_string * retval = sh_string_new_from_lchar(sh_string_str(message), 
-						sh_string_len(message));
-
-  if (ovecnum > 1)
-    {
-      retval = sh_string_replace(retval, &(ovector[2]), (ovecnum-1), "___", 3);
-    }
-  return retval;
-}
-
 
 /* process the counter for a SUM rule
@@ -818,9 +948,8 @@
       if (queue->policy == EVAL_REPORT)
 	{
-	  DEBUG("debug: EVAL_REPORT host: %s, prefix: %s, message: %s\n",
+	  DEBUG("debug: EVAL_REPORT host: %s, message: %s\n",
 		 sh_string_str(record->host), 
-		 sh_string_str(record->prefix), 
 		 sh_string_str(record->message));
-	  msg_report(queue->severity, record);
+	  msg_report(queue->severity, rule, record);
 	  retval = 0;
 	}
@@ -830,7 +959,6 @@
 	  struct sh_ceval * counter = 
 	    find_counter(rule, record->host, queue->interval);
-	  DEBUG("debug: EVAL_SUM host: %s, prefix: %s, message: %s\n",
-		 sh_string_str(record->host), 
-		 sh_string_str(record->prefix), 
+	  DEBUG("debug: EVAL_SUM host: %s, message: %s\n",
+		 sh_string_str(record->host),
 		 sh_string_str(record->message));
 	  if (counter)
@@ -857,5 +985,5 @@
   if (record)
     {
-      struct sh_geval * rule = find_rule (record->host, record->prefix, 
+      struct sh_geval * rule = find_rule (record->host,
 					  record->message);
 
@@ -868,5 +996,5 @@
 	{
 	  DEBUG("debug: (%lu) no rule found\n", i); ++i;
-	  msg_report(DEFAULT_SEVERITY, record);
+	  msg_report(DEFAULT_SEVERITY, NULL, record);
 	}
       return 0;
