{{ ansible_header | comment }}
# Copyright 2008 Google Inc. All Rights Reserved.
# This file is available under the Apache license.

# Define the exported metric names.  The `by' keyword indicates the metric has
# dimensions.  For example, `request_total' counts the frequency of each
# request's "command".  The name `command' will be exported as the label name
# for the metric.  The command provided in the code below will be exported as
# the label value.
counter dhcpd_request_total by command
counter dhcpd_config_file_errors
counter dhcpd_peer_disconnects
counter dhcpd_dhcpdiscovers
counter dhcpd_bind_xid_mismatch
counter dhcpd_duplicate_lease
counter dhcpd_bad_udp_checksum
counter dhcpd_unknown_subnet
counter dhcpd_dhcpdiscover_nofree by network
counter dhcpd_unknown_lease by ip
counter dhcpd_update_rejected
counter dhcpd_failover_peer_timeout
counter dhcpd_ip_already_in_use
counter dhcpd_ip_abandoned by reason
counter dhcpd_invalid_state_transition
counter dhcpd_negative_poolreq by pool
counter dhcpd_lease_conflicts

# The `syslog' decorator defines a procedure.  When a block of mtail code is
# "decorated", it is called before entering the block.  The block is entered
# when the keyword `next' is reached.
def syslog {
  /^(?P<date>(?P<legacy_date>\w+\s+\d+\s+\d+:\d+:\d+)|(?P<rfc3339_date>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d+[+-]\d{2}:\d{2}))/ +
  /\s+(?:\w+@)?(?P<hostname>[\w\.-]+)\s+(?P<application>[\w\.-]+)(?:\[(?P<pid>\d+)\])?:\s+(?P<message>.*)/ {
    # If the legacy_date regexp matched, try this format.
    len($legacy_date) > 0 {
      strptime($2, "Jan _2 15:04:05")
    }
    # If the RFC3339 style matched, parse it this way.
    len($rfc3339_date) > 0 {
      strptime($rfc3339_date, "2006-01-02T03:04:05-0700")
    }
    # Call into the decorated block
    next
  }
}

# Define some pattern constants for reuse in the patterns below.
const IP /\d+(\.\d+){3}/
const MATCH_IP /(?P<ip>/ + IP + /)/
const MATCH_NETWORK /(?P<network>\d+(\.\d+){1,3}\/\d+)/
const MATCH_MAC /(?P<mac>([\da-f]{2}:){5}[\da-f]{2})/
    
@syslog {
    # Request
    $message =~ /^(balanced|balancing|BOOTREPLY|BOOTREQUEST|DHCPACK|DHCPDECLINE|DHCPDISCOVER|DHCPINFORM|DHCPNAK|DHCPOFFER|DHCPRELEASE|DHCPREQUEST)/ {
        # The lowercased name of the command matched in the regex is used to
        # count the frequency of each command.  An external collector can use
        # this to compute the rate of each command independently.
        dhcpd_request_total[tolower($1)]++

        # DHCP Discover
        $message =~ /^DHCPDISCOVER from / + MATCH_MAC {
            # Counts the discovery requests.
            dhcpd_dhcpdiscovers++

            /network / + MATCH_NETWORK + /: no free leases/ {
                # If the range is full, your clients may be having a bad time.
                dhcpd_dhcpdiscover_nofree[$network]++
            }
        }

    }

    # Config file errors
    /Configuration file errors encountered -- exiting/ {
        # Counting config parse errors can he useful for detecting bad config
        # pushes that made it to production.
        dhcpd_config_file_errors++
    }

    # Peer disconnects
    /peer ([^:]+): disconnected/ {
        dhcpd_peer_disconnects++
    }

    # XID mismatches
    /bind update on / + IP + / got ack from (?P<group>\w+): xid mismatch./ {
        dhcpd_bind_xid_mismatch++
    }

    # Duplicate lease
    /uid lease / + MATCH_IP + / for client / + MATCH_MAC + / is duplicate on / + MATCH_NETWORK {
        dhcpd_duplicate_lease++
    }

    # Bad UDP Checksum
    /(?P<count>\d+) bad udp checksums in \d+ packets/ {
        dhcpd_bad_udp_checksum += $count
    }

    # Unknown subnet
    /DHCPDISCOVER from / + MATCH_MAC + / via / + IP + /: unknown network segment/ {
        dhcpd_unknown_subnet++
    }

    # Unknown lease
    /DHCPREQUEST for / + IP + /\(/ + IP + /\) from / + MATCH_MAC + / via / + IP + /: unknown lease / + MATCH_IP {
        dhcpd_unknown_lease[$ip]++
    }

    # Update rejected
    /bind update on \S+ from \S+ rejected: incoming update is less critical than the outgoing update/ {
        dhcpd_update_rejected++
    }
    
    /timeout waiting for failover peer \S+/ {
        dhcpd_failover_peer_timeout++
    }
    
    /ICMP Echo reply while lease / + IP + /valid/ {
        dhcpd_ip_already_in_use++
    }
    
    /unexpected ICMP Echo reply from / + IP {
        dhcpd_ip_already_in_use++
    }
    
    /Abandoning IP address / + IP + /: (?P<reason>.*)/ {
        dhcpd_ip_abandoned[$reason]++
    }

    /bind update on \S+ from \S+ rejected: / + IP + /: invalid state transition/ {
        dhcpd_invalid_state_transition++
    }

    /peer (?P<pool>[^:]+): Got POOLREQ, answering negatively!/ {
        dhcpd_negative_poolreq[$pool]++
    }

    /Lease conflict at/ {
        dhcpd_lease_conflicts++
    }
}