setup.php

<?php
/*
 +-------------------------------------------------------------------------+
 | Copyright (C) 2004-2026 The Cacti Group                                 |
 |                                                                         |
 | This program is free software; you can redistribute it and/or           |
 | modify it under the terms of the GNU General Public License             |
 | as published by the Free Software Foundation; either version 2          |
 | of the License, or (at your option) any later version.                  |
 |                                                                         |
 | This program is distributed in the hope that it will be useful,         |
 | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
 | GNU General Public License for more details.                            |
 +-------------------------------------------------------------------------+
 | Cacti: The Complete RRDTool-based Graphing Solution                     |
 +-------------------------------------------------------------------------+
 | This code is designed, written, and maintained by the Cacti Group. See  |
 | about.php and/or the AUTHORS file for specific developer information.   |
 +-------------------------------------------------------------------------+
 | http://www.cacti.net/                                                   |
 +-------------------------------------------------------------------------+
*/

/**
 * Install the Syslog plugin, registering its hooks, realms and database tables.
 *
 * @return bool|void True when the install action was queued or completed, false
 *                   when the Syslog config file has not been created yet, and
 *                   nothing when the install is already running in the background.
 */
function plugin_syslog_install() {
	global $config, $syslog_upgrade;
	static $bg_inprocess = false;

	syslog_determine_config();

	if (defined('SYSLOG_CONFIG')) {
		include(SYSLOG_CONFIG);
	} else {
		raise_message('syslog_info', __('Please rename either your config.php.dist or config_local.php.dist files in the syslog directory, and change setup your database before installing.', 'syslog'), MESSAGE_LEVEL_ERROR);

		return false;
	}

	syslog_connect();

	/** @var string $syslogdb_default The name of the Syslog database, defined in the Syslog config file. */
	$syslog_exists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

	// ================= input validation =================
	get_filter_request_var('days');
	// ====================================================

	api_plugin_register_hook('syslog', 'config_arrays',         'syslog_config_arrays',        'setup.php');
	api_plugin_register_hook('syslog', 'draw_navigation_text',  'syslog_draw_navigation_text', 'setup.php');
	api_plugin_register_hook('syslog', 'config_settings',       'syslog_config_settings',      'setup.php');
	api_plugin_register_hook('syslog', 'settings_bottom',       'syslog_settings_bottom',      'setup.php', 1);
	api_plugin_register_hook('syslog', 'top_header_tabs',       'syslog_show_tab',             'setup.php');
	api_plugin_register_hook('syslog', 'top_graph_header_tabs', 'syslog_show_tab',             'setup.php');
	api_plugin_register_hook('syslog', 'top_graph_refresh',     'syslog_top_graph_refresh',    'setup.php');
	api_plugin_register_hook('syslog', 'poller_bottom',         'syslog_poller_bottom',        'setup.php');
	api_plugin_register_hook('syslog', 'graph_buttons',         'syslog_graph_buttons',        'setup.php');
	api_plugin_register_hook('syslog', 'config_insert',         'syslog_config_insert',        'setup.php');
	api_plugin_register_hook('syslog', 'utilities_list',        'syslog_utilities_list',       'setup.php');
	api_plugin_register_hook('syslog', 'utilities_action',      'syslog_utilities_action',     'setup.php');

	// hook for table replication
	api_plugin_register_hook('syslog', 'replicate_out',         'syslog_replicate_out',        'setup.php');

	api_plugin_register_realm('syslog', 'syslog.php', 'Syslog User', 1);
	api_plugin_register_realm('syslog', 'syslog_alerts.php,syslog_removal.php,syslog_reports.php', 'Rule Viewer', 1);
	api_plugin_register_realm('syslog', 'syslog_rule_administrator.php,syslog_device_rules.php', 'Rule Administrator', 1);
	api_plugin_register_realm('syslog', 'syslog_saved_searches.php,syslog_dashboards.php', 'Syslog Administration', 1);
	api_plugin_register_realm('syslog', 'syslog_saved_searches_share.php', 'Share Saved Templates', 1);
	api_plugin_register_realm('syslog', 'syslog_dashboards_share.php', 'Share Dashboards', 1);
	api_plugin_register_realm('syslog', 'syslog_administrator.php', 'Syslog Administrator', 1);

	if (isset_request_var('install')) {
		if (!$bg_inprocess) {
			syslog_execute_update($syslog_exists, $_REQUEST);
			$bg_inprocess = true;

			return true;
		}
	} elseif (isset($syslog_install_options) && cacti_sizeof($syslog_install_options)) {
		// hack for syslog so IBM Spectrum LSF RTM can install syslog without user interaction with preset defaults
		if (!$bg_inprocess) {
			/** @var array<string, mixed> $syslog_install_options Optional pre-configured install options, defined in the Syslog config file. */
			syslog_execute_update($syslog_exists, $syslog_install_options);
			$bg_inprocess = true;
		}
	} elseif (isset_request_var('cancel')) {
		header('Location:' . $config['url_path'] . 'plugins.php?mode=uninstall&id=syslog&uninstall&uninstall_method=all');
		exit;
	} else {
		syslog_install_advisor($syslog_exists);
		exit;
	}
}

/**
 * Perform the requested Syslog install or upgrade action.
 *
 * @param int                  $syslog_exists Whether the Syslog table already exists.
 * @param array<string, mixed> $options       The install options, either from the
 *                                            request or the Syslog config file.
 *
 * @return void
 */
function syslog_execute_update(int $syslog_exists, array $options): void {
	global $config;

	if (isset($options['cancel'])) {
		header('Location:' . $config['url_path'] . 'plugins.php?mode=uninstall&id=syslog&uninstall&uninstall_method=all');
		exit;
	}

	if (isset($options['return'])) {
		db_execute('DELETE FROM plugin_config WHERE directory="syslog"');
		db_execute('DELETE FROM plugin_realms WHERE plugin="syslog"');
		db_execute('DELETE FROM plugin_db_changes WHERE plugin="syslog"');
		db_execute('DELETE FROM plugin_hooks WHERE name="syslog"');
	} elseif (isset($options['upgrade_type'])) {
		if ($options['upgrade_type'] == 'truncate') {
			syslog_setup_table_new($options);
		}
	} else {
		syslog_setup_table_new($options);
	}

	set_config_option('syslog_retention', $options['days']);
}

/**
 * Uninstall the Syslog plugin, optionally removing its database tables.
 *
 * @return void
 */
function plugin_syslog_uninstall(): void {
	global $config, $syslogdb_default;

	syslog_determine_config();
	syslog_connect();

	if (isset_request_var('cancel') || isset_request_var('return')) {
		header('Location:' . $config['url_path'] . 'plugins.php?header=false');
		exit;
	}

	if (isset_request_var('uninstall_method')) {
		if (get_nfilter_request_var('uninstall_method') == 'all') {
			// do the big tables first
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");

			// do the settings tables last
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_incoming`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_remove`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_reports`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_facilities`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_statistics`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_host_facilities`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_priorities`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_logs`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_hosts`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_saved_searches`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_dashboard_panels`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_dashboards`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_dashboards_perm`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_saved_searches_perm`");
		} else {
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
			syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");
		}
	} elseif (function_exists('syslog_uninstall_advisor')) {
		syslog_uninstall_advisor();
		exit;
	}
}

/**
 * Check that the Syslog config file has been created before installing.
 *
 * @return bool True when either config file is present, false otherwise.
 */
function plugin_syslog_check_config(): bool {
	// Here we will check to ensure everything is configured
	if (!file_exists(__DIR__ . '/config_local.php') && !file_exists(__DIR__ . '/config.php')) {
		raise_message('syslog_info', __('Please rename either your config.php.dist or config_local.php.dist files in the syslog directory, and change setup your database before installing.', 'syslog'), MESSAGE_LEVEL_ERROR);

		return false;
	}

	if (api_plugin_installed('flowview')) {
		syslog_check_upgrade();
	}

	return true;
}

/**
 * Upgrade the Syslog plugin to the newest version.
 *
 * @return bool Always false, the upgrade is handled by syslog_check_upgrade().
 */
function plugin_syslog_upgrade(): bool {
	// Here we will upgrade to the newest version
	api_plugin_register_hook('syslog', 'settings_bottom', 'syslog_settings_bottom', 'setup.php', 1);
	syslog_check_upgrade();

	return false;
}

/**
 * Connect to the Syslog database, either the local Cacti database or a remote one.
 *
 * @return bool True when a Syslog database connection is available, false otherwise.
 */
function syslog_connect(): bool {
	global $config, $syslog_cnn, $syslogdb_default, $local_db_cnn_id, $remote_db_cnn_id, $syslog_incoming_config;

	syslog_determine_config();

	// Handle remote syslog processing
	if (defined('SYSLOG_CONFIG')) {
		include(SYSLOG_CONFIG);
	}

	include_once(__DIR__ . '/functions.php');
	include_once(__DIR__ . '/database.php');

	$connect_remote = false;
	$connected      = true;

	// Connect to the Syslog Database
	if (empty($syslog_cnn)) {
		/** @var bool $use_cacti_db Whether the Syslog tables live in the local Cacti database, defined in the Syslog config file. */
		if ($config['poller_id'] == 1) {
			if ($use_cacti_db == true) {
				$syslog_cnn = $local_db_cnn_id;
				$connected  = true;
			} else {
				$connect_remote = true;
			}
		} elseif (isset($config['syslog_remote_db'])) {
			if ($use_cacti_db == true) {
				$syslog_cnn = $local_db_cnn_id;
				$connected  = true;
			} else {
				$connect_remote = true;
			}
		} else {
			if ($use_cacti_db == true) {
				$syslog_cnn = $remote_db_cnn_id;
				$connected  = true;
			} else {
				$connect_remote = true;
			}
		}

		if ($connect_remote) {
			if (!isset($syslogdb_port)) {
				$syslogdb_port = '3306';
			}

			if (!isset($syslogdb_retries)) {
				$syslogdb_retries = '5';
			}

			if (!isset($syslogdb_ssl)) {
				$syslogdb_ssl = false;
			}

			if (!isset($syslogdb_ssl_key)) {
				$syslogdb_ssl_key = '';
			}

			if (!isset($syslogdb_ssl_cert)) {
				$syslogdb_ssl_cert = '';
			}

			if (!isset($syslogdb_ssl_ca)) {
				$syslogdb_ssl_ca = '';
			}

			/**
			 * @var string $syslogdb_hostname The hostname of the Syslog database server.
			 * @var string $syslogdb_username The username for the Syslog database server.
			 * @var string $syslogdb_password The password for the Syslog database server.
			 * @var string $syslogdb_type     The database type of the Syslog database server.
			 */
			$syslog_cnn = syslog_db_connect_real($syslogdb_hostname, $syslogdb_username, $syslogdb_password, $syslogdb_default, $syslogdb_type, $syslogdb_port, $syslogdb_retries, $syslogdb_ssl, $syslogdb_ssl_key, $syslogdb_ssl_cert, $syslogdb_ssl_ca);

			if ($syslog_cnn == false) {
				print "FATAL Can not connect\n";
				$connected = false;
			}
		}

		if ($connected && !syslog_db_table_exists('syslog') && api_plugin_is_enabled('syslog')) {
			cacti_log('Setting Up Database Tables Since they do not exist', false, 'SYSLOG');

			if (!isset($syslog_install_options)) {
				$syslog_install_options = [];
			}

			syslog_setup_table_new($syslog_install_options);
		}
	}

	return $connected;
}

/**
 * Repair old installs before Cacti's auth.php checks the requested page.
 *
 * @return void
 */
function syslog_upgrade_saved_search_realm(): void {
	global $user_auth_realm_filenames;

	$admin = null;
	$template = null;
	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (is_array($realms)) {
		foreach ($realms as $realm) {
			$files = explode(',', $realm['file']);
			if (in_array('syslog_alerts.php', $files, true) && ($realm['display'] ?? '') !== 'Rule Viewer') {
				$admin = $realm;
			}
			if (in_array('syslog_saved_searches.php', $files, true)) {
				$template = $realm;
			}
		}
	}

	if ($admin === null) {
		return;
	}

	if ($template === null) {
		// Keep the realm ID: existing user and group grants must not change.
		if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?',
			[$admin['file'] . ',syslog_saved_searches.php', $admin['id'], 'syslog'])) {
			return;
		}
		$template = $admin;
		api_plugin_replicate_config();
	}

	// A legacy standalone realm retains its grants. Administrators can also
	// access Templates, without granting legacy template users other admin pages.
	// Update the already-loaded map so the repair works on this request too.
	if ($template['id'] == $admin['id'] || api_plugin_user_realm_auth('syslog_alerts.php')) {
		$user_auth_realm_filenames['syslog_saved_searches.php'] = (int) $admin['id'] + 100;
	}
}

/**
 * Give pre-existing installs the Dashboards console page inside the admin realm.
 *
 * @return void
 */
function syslog_upgrade_dashboard_realm(): void {
	global $user_auth_realm_filenames;

	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (is_array($realms)) {
		foreach ($realms as $realm) {
			$files = explode(',', $realm['file']);
			if (!in_array('syslog_alerts.php', $files, true) || ($realm['display'] ?? '') === 'Rule Viewer') {
				continue;
			}

			if (in_array('syslog_dashboards.php', $files, true)) {
				return;
			}

			// Keep the realm ID: existing user and group grants must not change.
			if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?',
				[$realm['file'] . ',syslog_dashboards.php', $realm['id'], 'syslog'])) {
				return;
			}
			api_plugin_replicate_config();

			// Update the already-loaded map so the repair works on this request too.
			$user_auth_realm_filenames['syslog_dashboards.php'] = (int) $realm['id'] + 100;

			return;
		}
	}
}

/** Give Rule Administrators access to device alert rules. */
function syslog_upgrade_device_rule_realm(): void {
	global $user_auth_realm_filenames;
	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);
	if (!is_array($realms)) {
		return;
	}
	foreach ($realms as $realm) {
		if (($realm['display'] ?? '') !== 'Rule Administrator') {
			continue;
		}
		$files = explode(',', $realm['file']);
		if (!in_array('syslog_device_rules.php', $files, true)) {
			$files[] = 'syslog_device_rules.php';
			if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?', [implode(',', $files), $realm['id'], 'syslog'])) {
				return;
			}
			api_plugin_replicate_config();
		}
		$user_auth_realm_filenames['syslog_device_rules.php'] = (int) $realm['id'] + 100;
		return;
	}
}

/**
 * Preserve existing Syslog Administration grants as Rule Administrator grants.
 *
 * Rule pages must be registered to the Rule Viewer realm so Cacti can admit
 * read-only users before page code runs.  The administrator realm is a
 * permission-only entry that the rule pages check before every mutation.
 * Legacy combined realms must not retain Saved Search Templates or Dashboards:
 * those pages belong exclusively to the separate Syslog Administration realm.
 *
 * @return void
 */
function syslog_upgrade_rule_permissions(): void {
	global $user_auth_realm_filenames;

	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ?', ['syslog']);

	if (!is_array($realms)) {
		return;
	}

	foreach ($realms as $realm) {
		$files = explode(',', $realm['file']);
		if (($realm['display'] ?? '') !== 'Syslog Administration' || !in_array('syslog_alerts.php', $files, true) || in_array('syslog_rule_administrator.php', $files, true)) {
			continue;
		}

		$files = array_values(array_diff($files, [
			'syslog_alerts.php',
			'syslog_removal.php',
			'syslog_reports.php',
			'syslog_saved_searches.php',
			'syslog_dashboards.php'
		]));
		$files[] = 'syslog_rule_administrator.php';

		if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ? AND plugin = ?',
			[implode(',', $files), $realm['id'], 'syslog'])) {
			return;
		}

		api_plugin_replicate_config();
		$user_auth_realm_filenames['syslog_rule_administrator.php'] = (int) $realm['id'] + 100;

		return;
	}
}

/**
 * Merge duplicate granular-rule realms created by earlier registrations.
 *
 * Cacti renders one permission checkbox per realm record.  If an install has
 * several records with the same Rule Viewer or Rule Administrator label, the
 * permissions screen repeats that label. Preserve their grants in the first
 * record and restore canonical filenames so the roles remain separate.
 *
 * @return bool Whether duplicate repair succeeded.
 */
function syslog_upgrade_consolidate_rule_realms(): bool {
	$changed = false;

	foreach (['Rule Viewer', 'Rule Administrator'] as $display) {
		$realms = db_fetch_assoc_prepared('SELECT id, file FROM plugin_realms WHERE plugin = ? AND display = ? ORDER BY id', ['syslog', $display]);
		$files = $display === 'Rule Viewer' ? 'syslog_alerts.php,syslog_removal.php,syslog_reports.php' : 'syslog_rule_administrator.php';

		if (!is_array($realms) || !$realms || (count($realms) === 1 && $realms[0]['file'] === $files)) {
			continue;
		}

		$keeper = array_shift($realms);
		if (!db_begin_transaction()) {
			return false;
		}

		foreach ($realms as $realm) {
			foreach (['user_auth_realm' => 'user_id', 'user_auth_group_realm' => 'group_id'] as $table => $owner) {
				if (!db_execute_prepared("INSERT IGNORE INTO $table ($owner, realm_id) SELECT $owner, ? FROM $table WHERE realm_id = ?", [(int) $keeper['id'] + 100, (int) $realm['id'] + 100]) ||
					!db_execute_prepared("DELETE FROM $table WHERE realm_id = ?", [(int) $realm['id'] + 100])) {
					db_rollback_transaction();
					return false;
				}
			}
			if (!db_execute_prepared('DELETE FROM plugin_realms WHERE id = ? AND plugin = ?', [(int) $realm['id'], 'syslog'])) {
				db_rollback_transaction();
				return false;
			}
		}

		// Broken migrations put the administrator filename in Viewer records.
		// Never union those files: doing so merges the two permission levels.
		if (!db_execute_prepared('UPDATE plugin_realms SET file = ? WHERE id = ?', [$files, (int) $keeper['id']]) || !db_commit_transaction()) {
			db_rollback_transaction();
			return false;
		}
		$changed = true;
	}

	if ($changed) {
		api_plugin_replicate_config();
	}
	return true;
}

/** Refresh permission labels, filenames and grouping from current realm IDs. */
function syslog_refresh_permission_roles(): void {
	global $user_auth_realms, $user_auth_realm_filenames, $user_auth_roles;

	$realms = db_fetch_assoc_prepared('SELECT id, file, display FROM plugin_realms WHERE plugin = ? ORDER BY id', ['syslog']);
	if (!is_array($realms)) {
		return;
	}
	$ids = [];
	foreach ($realms as $realm) {
		$id = (int) $realm['id'] + 100;
		$ids[] = $id;
		$user_auth_realms[$id] = $realm['display'];
		foreach (explode(',', $realm['file']) as $file) {
			$user_auth_realm_filenames[$file] = $id;
			unset($_SESSION['sess_auth_names'][$file]);
		}
	}
	// Assign actual IDs rather than cached filename lookups. This also removes
	// deleted duplicate IDs from the Syslog group on the current request.
	$user_auth_roles[__('Syslog', 'syslog')] = array_values(array_unique($ids));

	// Rule Administrator is the write permission paired with Rule Viewer.  Map
	// the rule page filenames to the administrator realm for an administrator
	// who does not also have the viewer realm, so Cacti can render the Syslog
	// Settings menu and admit the rule pages.  Do not include the separate
	// saved-search or dashboard administration pages here.
	$rule_administrator = $user_auth_realm_filenames['syslog_rule_administrator.php'] ?? 0;
	if ($rule_administrator && is_realm_allowed($rule_administrator)) {
		foreach (['syslog_alerts.php', 'syslog_removal.php', 'syslog_reports.php'] as $file) {
			$user_auth_realm_filenames[$file] = $rule_administrator;
		}
	}

	// Cacti filters console menus and authorizes pages from this map before the
	// page controllers run. Keep the stored permissions independent, but make
	// the aggregate administrator permission imply each Syslog capability for
	// the current user.
	$administrator = $user_auth_realm_filenames['syslog_administrator.php'] ?? 0;
	if ($administrator && is_realm_allowed($administrator)) {
		foreach ([
			'syslog.php',
			'syslog_alerts.php',
			'syslog_removal.php',
			'syslog_reports.php',
			'syslog_rule_administrator.php',
			'syslog_saved_searches.php',
			'syslog_saved_searches_share.php',
			'syslog_dashboards.php',
			'syslog_dashboards_share.php'
		] as $file) {
			$user_auth_realm_filenames[$file] = $administrator;
		}
	}
}

/**
 * Upgrade the Syslog database schema for legacy installs.
 *
 * @return void
 */
function syslog_check_upgrade(): void {
	global $config, $syslogdb_default, $syslog_levels, $syslog_upgrade;

	syslog_connect();
	syslog_upgrade_saved_search_realm();
	syslog_upgrade_dashboard_realm();
	syslog_upgrade_rule_permissions();
	if (!syslog_upgrade_consolidate_rule_realms()) {
		return;
	}
	// Keep newly introduced permission realms available for existing installs.
	api_plugin_register_realm('syslog', 'syslog_alerts.php,syslog_removal.php,syslog_reports.php', 'Rule Viewer', 0);
	api_plugin_register_realm('syslog', 'syslog_rule_administrator.php,syslog_device_rules.php', 'Rule Administrator', 0);
	api_plugin_register_realm('syslog', 'syslog_saved_searches.php,syslog_dashboards.php', 'Syslog Administration', 0);
	api_plugin_register_realm('syslog', 'syslog_saved_searches_share.php', 'Share Saved Templates', 0);
	api_plugin_register_realm('syslog', 'syslog_dashboards_share.php', 'Share Dashboards', 0);
	api_plugin_register_realm('syslog', 'syslog_administrator.php', 'Syslog Administrator', 0);
	syslog_upgrade_device_rule_realm();
	syslog_refresh_permission_roles();

	// Let's only run this check if we are on a page that actually needs the data
	$files = ['plugins.php', 'syslog.php', 'syslog_removal.php', 'syslog_alerts.php', 'syslog_device_rules.php', 'syslog_reports.php', 'syslog_saved_searches.php', 'syslog_dashboards.php'];

	if (substr($_SERVER['SCRIPT_FILENAME'], -18) != 'syslog_process.php' && !in_array(get_current_page(), $files, true)) {
		return;
	}

	// don't let this script timeout
	ini_set('max_execution_time', 0);

	if (function_exists('api_plugin_upgrade_register')) {
		if (!api_plugin_upgrade_register('syslog')) {
			// No upgrade required, but still warn about deprecated table layouts
			syslog_notice_traditional_tables(true);

			return;
		}
	} else {
		$version = plugin_syslog_version();
		$current = $version['version'];
		$old     = db_fetch_cell("SELECT version FROM plugin_config WHERE directory='syslog'");

		if ($current != $old) {
			api_plugin_register_hook('syslog', 'replicate_out', 'syslog_replicate_out', 'setup.php', 1);

			db_execute_prepared('UPDATE plugin_config SET
				version = ?, name = ?, author = ?, webpage = ?
				WHERE directory = ?',
				[
					$version['version'],
					$version['longname'],
					$version['author'],
					$version['homepage'],
					$version['name']
				]
			);
		} else {
			// No upgrade required, but still warn about deprecated table layouts
			syslog_notice_traditional_tables(true);

			return;
		}
	}

	if (!syslog_db_column_exists('syslog_alert', 'hash')) {
		syslog_db_add_column('syslog_alert', [
			'name'     => 'hash',
			'type'     => 'varchar(32)',
			'NULL'     => false,
			'default'  => '',
			'after'    => 'id']
		);

		syslog_db_add_column('syslog_remove', [
			'name'     => 'hash',
			'type'     => 'varchar(32)',
			'NULL'     => false,
			'default'  => '',
			'after'    => 'id']
		);

		syslog_db_add_column('syslog_reports', [
			'name'     => 'hash',
			'type'     => 'varchar(32)',
			'NULL'     => false,
			'default'  => '',
			'after'    => 'id']
		);
	}

	if (syslog_db_column_exists('syslog_incoming', 'date')) {
		syslog_db_execute("ALTER TABLE syslog_incoming
			DROP COLUMN date,
			CHANGE COLUMN `time` logtime timestamp default '0000-00-00';");
	}

	if (syslog_db_column_exists('syslog_alert', 'hash')) {
		$alerts = syslog_db_fetch_assoc('SELECT *
			FROM syslog_alert
			WHERE hash IS NULL OR hash = ""');

		if (cacti_sizeof($alerts)) {
			foreach ($alerts as $a) {
				$hash = get_hash_syslog($a['id'], 'syslog_alert');
				syslog_db_execute_prepared('UPDATE syslog_alert
					SET hash = ?
					WHERE id = ?',
					[$hash, $a['id']]);
			}
		}
	}

	if (syslog_db_column_exists('syslog_remove', 'hash')) {
		$removes = syslog_db_fetch_assoc('SELECT *
			FROM syslog_remove
			WHERE hash IS NULL OR hash = ""');

		if (cacti_sizeof($removes)) {
			foreach ($removes as $r) {
				$hash = get_hash_syslog($r['id'], 'syslog_remove');
				syslog_db_execute_prepared('UPDATE syslog_remove
					SET hash = ?
					WHERE id = ?',
					[$hash, $r['id']]);
			}
		}
	}

	if (syslog_db_column_exists('syslog_reports', 'hash')) {
		$reports = syslog_db_fetch_assoc('SELECT *
			FROM syslog_reports
			WHERE hash IS NULL OR hash = ""');

		if (cacti_sizeof($reports)) {
			foreach ($reports as $r) {
				$hash = get_hash_syslog($r['id'], 'syslog_reports');
				syslog_db_execute_prepared('UPDATE syslog_reports
					SET hash = ?
					WHERE id = ?',
					[$hash, $r['id']]);
			}
		}
	}

	if (syslog_db_column_exists('syslog_saved_searches', 'hash')) {
		$searches = syslog_db_fetch_assoc('SELECT *
			FROM syslog_saved_searches
			WHERE hash IS NULL OR hash = ""');

		if (cacti_sizeof($searches)) {
			foreach ($searches as $s) {
				$hash = get_hash_syslog($s['id'], 'syslog_saved_searches');
				syslog_db_execute_prepared('UPDATE syslog_saved_searches
					SET hash = ?
					WHERE id = ?',
					[$hash, $s['id']]);
			}
		}
	}

	if (syslog_db_column_exists('syslog_dashboards', 'hash')) {
		$dashboards = syslog_db_fetch_assoc('SELECT *
			FROM syslog_dashboards
			WHERE hash IS NULL OR hash = ""');

		if (cacti_sizeof($dashboards)) {
			foreach ($dashboards as $d) {
				$hash = get_hash_syslog($d['id'], 'syslog_dashboards');
				syslog_db_execute_prepared('UPDATE syslog_dashboards
					SET hash = ?
					WHERE id = ?',
					[$hash, $d['id']]);
			}
		}
	}

	if (!syslog_db_column_exists('syslog_alert', 'level')) {
		syslog_db_add_column('syslog_alert', [
			'name'     => 'level',
			'type'     => 'int(10)',
			'unsigned' => true,
			'NULL'     => false,
			'default'  => '0',
			'after'    => 'method']
		);
	}

	if (!syslog_db_column_exists('syslog_alert', 'notify')) {
		syslog_db_add_column('syslog_alert', [
			'name'     => 'notify',
			'type'     => 'int(10)',
			'unsigned' => true,
			'NULL'     => false,
			'default'  => '0',
			'after'    => 'email']
		);
	}

	if (!syslog_db_column_exists('syslog_alert', 'body')) {
		syslog_db_add_column('syslog_alert', [
			'name'     => 'body',
			'type'     => 'varchar(8192)',
			'NULL'     => false,
			'default'  => '',
			'after'    => 'message']
		);
	}

	foreach ([
		['cooldown_minutes', 'int(10)', '-1', 'repeat_alert'],
		['deduplication_minutes', 'int(10)', '-1', 'cooldown_minutes'],
		['suppression_schedule', 'text', '', 'deduplication_minutes'],
		['maintenance_mode', 'varchar(16)', 'inherit', 'suppression_schedule'],
		['maintenance_days', 'varchar(32)', '1,2,3,4,5', 'maintenance_mode'],
		['maintenance_start', 'char(5)', '00:00', 'maintenance_days'],
		['maintenance_end', 'char(5)', '00:00', 'maintenance_start'],
		['maintenance_datetime_start', 'varchar(16)', '', 'maintenance_end'],
		['maintenance_datetime_end', 'varchar(16)', '', 'maintenance_datetime_start']
	] as [$name, $type, $default, $after]) {
		if (!syslog_db_column_exists('syslog_alert', $name)) {
			syslog_db_add_column('syslog_alert', [
				'name'     => $name,
				'type'     => $type,
				'NULL'     => false,
				'default'  => $default,
				'after'    => $after]
			);
		}
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_alert_suppression` (
		`alert_id` int(10) unsigned NOT NULL,
		`scope_key` varchar(255) NOT NULL,
		`dedup_hash` char(40) NOT NULL,
		`last_sent` int(10) unsigned NOT NULL default '0',
		PRIMARY KEY (`alert_id`, `scope_key`, `dedup_hash`),
		INDEX `last_sent` (`last_sent`))
		ENGINE=InnoDB");

	// Structured filter JSON can exceed the old VARCHAR limit. TEXT also keeps
	// the alert table below the InnoDB/MariaDB inline row-size ceiling.
	syslog_db_execute('ALTER TABLE syslog_alert MODIFY column message TEXT NOT NULL');

	// Removal rules now store the same structured filter JSON as alert rules.
	syslog_db_execute('ALTER TABLE syslog_remove MODIFY column message TEXT NOT NULL');

	if (!syslog_db_column_exists('syslog_reports', 'notify')) {
		syslog_db_add_column('syslog_reports', [
			'name'     => 'notify',
			'type'     => 'int(10)',
			'unsigned' => true,
			'NULL'     => false,
			'default'  => '0',
			'after'    => 'email']
		);
	}

	syslog_db_execute('ALTER TABLE syslog_reports MODIFY column body VARCHAR(8192) NOT NULL default ""');

	if (!syslog_db_table_exists('syslog_saved_searches', false)) {
		syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_saved_searches` (
			`id` int(10) NOT NULL auto_increment,
			`hash` varchar(32) NOT NULL default '',
			`name` varchar(128) NOT NULL default '',
			`search` text NOT NULL,
			`removal` int(10) NOT NULL default '1',
			`grouping` int(10) NOT NULL default '0',
			`user` varchar(32) NOT NULL default '',
			`is_global` char(2) NOT NULL default '',
			`date` int(16) NOT NULL default '0',
			PRIMARY KEY (`id`),
			KEY owner (`user`))
			ENGINE=InnoDB
			ROW_FORMAT=Dynamic");
	}

	if (!syslog_db_column_exists('syslog_saved_searches', 'hash')) {
		syslog_db_add_column('syslog_saved_searches', [
			'name'    => 'hash',
			'type'    => 'varchar(32)',
			'NULL'    => false,
			'default' => '',
			'after'   => 'id']
		);
	}

	if (!syslog_db_table_exists('syslog_dashboards', false)) {
		syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_dashboards` (
			`id` int(10) NOT NULL auto_increment,
			`hash` varchar(32) NOT NULL default '',
			`name` varchar(128) NOT NULL default '',
			`user` varchar(32) NOT NULL default '',
			`is_global` char(2) NOT NULL default '',
			`date` int(16) NOT NULL default '0',
			`updated` int(16) NOT NULL default '0',
			PRIMARY KEY (`id`),
			KEY owner (`user`))
			ENGINE=InnoDB
			ROW_FORMAT=Dynamic");
	}

	if (!syslog_db_column_exists('syslog_dashboards', 'hash')) {
		syslog_db_add_column('syslog_dashboards', [
			'name'    => 'hash',
			'type'    => 'varchar(32)',
			'NULL'    => false,
			'default' => '',
			'after'   => 'id']
		);
	}

	if (!syslog_db_table_exists('syslog_dashboard_panels', false)) {
		syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_dashboard_panels` (
			`id` int(10) NOT NULL auto_increment,
			`dashboard_id` int(10) NOT NULL default '0',
			`title` varchar(128) NOT NULL default '',
			`expression` text NOT NULL,
			`source` varchar(16) NOT NULL default 'syslog',
			`removal` int(10) NOT NULL default '1',
			`kind` varchar(16) NOT NULL default 'timeseries',
			`chart` varchar(16) NOT NULL default 'line',
			`field` varchar(16) NOT NULL default 'host',
			`interval` varchar(16) NOT NULL default 'dashboard',
			`timespan` varchar(16) NOT NULL default 'dashboard',
			`top_n` int(10) NOT NULL default '10',
			`width` smallint(5) unsigned NOT NULL default '1',
			`height` smallint(5) unsigned NOT NULL default '0',
			`position` int(10) NOT NULL default '0',
			`date` int(16) NOT NULL default '0',
			PRIMARY KEY (`id`),
			KEY dashboard (`dashboard_id`))
			ENGINE=InnoDB
			ROW_FORMAT=Dynamic");
	}

	// Panel resizing persists a grid span and chart height per panel.
	if (!syslog_db_column_exists('syslog_dashboard_panels', 'width')) {
		syslog_db_add_column('syslog_dashboard_panels', [
			'name'    => 'width',
			'type'    => 'smallint(5) unsigned',
			'NULL'    => false,
			'default' => '1',
			'after'   => 'top_n']
		);
	}

	if (!syslog_db_column_exists('syslog_dashboard_panels', 'height')) {
		syslog_db_add_column('syslog_dashboard_panels', [
			'name'    => 'height',
			'type'    => 'smallint(5) unsigned',
			'NULL'    => false,
			'default' => '0',
			'after'   => 'width']
		);
	}

	// Sharing persists a global flag on the dashboard itself.
	if (!syslog_db_column_exists('syslog_dashboards', 'is_global')) {
		syslog_db_add_column('syslog_dashboards', [
			'name'    => 'is_global',
			'type'    => 'char(2)',
			'NULL'    => false,
			'default' => '',
			'after'   => 'user']
		);
	}

	// Per-user and per-group grants from the admin Dashboards page, beyond
	// the owner and the global share flag.
	if (!syslog_db_table_exists('syslog_dashboards_perm', false)) {
		syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_dashboards_perm` (
			`dashboard_id` int(10) NOT NULL default '0',
			`type` varchar(5) NOT NULL default '',
			`item_id` int(10) NOT NULL default '0',
			PRIMARY KEY (`dashboard_id`, `type`, `item_id`))
			ENGINE=InnoDB
			ROW_FORMAT=Dynamic");
	}

	// The same grants for saved searches.
	if (!syslog_db_table_exists('syslog_saved_searches_perm', false)) {
		syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_saved_searches_perm` (
			`search_id` int(10) NOT NULL default '0',
			`type` varchar(5) NOT NULL default '',
			`item_id` int(10) NOT NULL default '0',
			PRIMARY KEY (`search_id`, `type`, `item_id`))
			ENGINE=InnoDB
			ROW_FORMAT=Dynamic");
	}

	if (!syslog_db_table_exists('syslog_status', false)) {
		syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_status` (
			`name` varchar(64) NOT NULL default '',
			`value` text NOT NULL,
			`updated` int(16) NOT NULL default '0',
			PRIMARY KEY (`name`))
			ENGINE=InnoDB
			ROW_FORMAT=Dynamic");
	} else {
		syslog_db_execute("ALTER TABLE `$syslogdb_default`.`syslog_status` MODIFY column `value` TEXT NOT NULL");
	}
}

/**
 * Create the partitioned Syslog table, including past and future partitions.
 *
 * @param string           $engine     The storage engine to create the table with.
 * @param float|int|string $days       The number of days of retention to provision.
 * @param int|string|false $ahead_days The number of days of partitions to create
 *                                     ahead of today, or false when unconfigured.
 *
 * @return void
 */
function syslog_create_partitioned_syslog_table($engine = 'InnoDB', $days = 30, $ahead_days = 3) {
	global $config, $syslogdb_default, $syslog_levels;

	syslog_connect();

	$engine = syslog_validate_storage_engine($engine);

	// Guard the partition loop against non-numeric or extreme values: a
	// crafted 'days' option would otherwise loop indefinitely or emit a
	// very large DDL statement.
	$days = (int) $days;

	if ($days < 0 || $days > 365) {
		$days = 30;
	}

	if (!is_numeric($ahead_days) || (int) $ahead_days < 1 || (int) $ahead_days > 7) {
		$ahead_days = 3;
	}

	$ahead_days = (int) $ahead_days;

	if (stripos($engine, 'aria') !== false) {
		$row_format = 'ROW_FORMAT=Page';
	} else {
		$row_format = 'ROW_FORMAT=Dynamic';
	}

	$sql = "CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog` (
		facility_id int(10) unsigned default NULL,
		priority_id int(10) unsigned default NULL,
		program_id int(10) unsigned default NULL,
		host_id int(10) unsigned default NULL,
		logtime timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',
		message varchar(1024) NOT NULL default '',
		seq bigint unsigned NOT NULL auto_increment,
		PRIMARY KEY(seq, logtime),
		INDEX `seq` (`seq`),
		INDEX logtime (logtime),
		INDEX program_id (program_id),
		INDEX host_id (host_id),
		INDEX priority_id (priority_id),
		INDEX facility_id (facility_id))
		ENGINE=$engine
		$row_format
		PARTITION BY RANGE (UNIX_TIMESTAMP(logtime))\n";

	$now = time();

	$parts = '';

	/*
	 * Partition boundaries are integer epochs computed in PHP and injected
	 * as numeric literals. This keeps both MySQL and PHP session time zones
	 * out of the equation: the boundary is always the next UTC midnight
	 * after the labeled day.
	 *
	 * $days counts today as one of the retained days, so the historical
	 * loop bound is $days - 1 (today plus $days - 1 prior days = $days
	 * total). This must stay in lockstep with the $days + $ahead_days
	 * "keep_partitions" math in syslog_partition_remove(), or newly
	 * installed tables over-provision by one partition and the very next
	 * retention prune immediately deletes the oldest one.
	 *
	 * $days = 0 is a valid "Indefinite" retention setting (never pruned by
	 * syslog_partition_remove(), which only prunes when $days > 0), but
	 * $days - 1 would then be -1 and skip creating today's concrete
	 * partition entirely. Clamp the starting bound to 0 so today is always
	 * created regardless of retention.
	 */
	for ($i = max($days - 1, 0); $i >= (0 - $ahead_days); $i--) {
		$day_epoch      = $now - ($i * 86400);
		$boundary_epoch = (intdiv($day_epoch, 86400) + 1) * 86400;
		$format         = gmdate('Ymd', $day_epoch);

		$parts .= ($parts !== '' ? ",\n" : '(') . ' PARTITION d' . $format . ' VALUES LESS THAN (' . $boundary_epoch . ')';
	}

	$parts .= ",\nPARTITION dMaxValue VALUES LESS THAN MAXVALUE);";

	syslog_db_execute($sql . $parts);
}

/**
 * Create the Syslog database tables, dropping existing ones on truncate.
 *
 * @param array<string, mixed> $options The install options, either from the
 *                                      request, saved settings, or the Syslog
 *                                      config file.
 *
 * @return void
 */
function syslog_setup_table_new(array $options): void {
	global $config, $settings, $syslogdb_default, $syslog_levels;

	syslog_connect();

	$tables  = [];

	$syslog_levels = [
		0 => 'emerg',
		1 => 'crit',
		2 => 'alert',
		3 => 'err',
		4 => 'warn',
		5 => 'notice',
		6 => 'info',
		7 => 'debug',
		8 => 'other'
	];

	// Set default if they are not set.
	if (!cacti_sizeof($options)) {
		$options['upgrade_type'] = read_config_option('syslog_install_upgrade_type');
		$options['engine']       = read_config_option('syslog_install_engine');
		$options['db_type']      = read_config_option('syslog_install_db_type');
		$options['days']         = read_config_option('syslog_install_days');

		if (empty($options['upgrade_type'])) {
			$options['upgrade_type'] = 'upgrade';
		}

		if (empty($options['engine'])) {
			$options['engine'] = 'InnoDB';
		}

		if (empty($options['db_type'])) {
			$options['db_type'] = 'part';
		}

		if (empty($options['days'])) {
			$options['days'] = 30;
		}
	}

	// Partitioned tables are the only supported architecture.  Traditional
	// (non-partitioned) tables are deprecated, so the 'trad' architecture
	// silently upgrades to partitioned table creation no matter how the
	// options were supplied (request, saved settings, or legacy config.php).
	if (!isset($options['db_type']) || $options['db_type'] != 'part') {
		if (isset($options['db_type']) && $options['db_type'] == 'trad') {
			cacti_log("SYSLOG WARNING: The 'trad' database architecture setting is deprecated.  Partitioned tables are the only supported architecture; creating partitioned tables", false, 'SYSLOG');
		}

		$options['db_type'] = 'part';
	}

	// validate some simple information
	$truncate     = isset($options['upgrade_type']) && $options['upgrade_type'] == 'truncate' ? true : false;
	$engine       = syslog_validate_storage_engine(isset($options['engine']) ? $options['engine'] : 'InnoDB');
	$syslogexists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

	// Aria is only supported on MariaDB.  If a legacy setting requests Aria
	// on MySQL, fall back to InnoDB so table creation cannot fail.
	if (stripos($engine, 'aria') !== false) {
		$database = syslog_db_fetch_row('SHOW GLOBAL VARIABLES LIKE "version"');
		$version  = is_array($database) && isset($database['Value']) ? (string) $database['Value'] : '';

		if (stripos($version, 'mariadb') === false) {
			cacti_log('SYSLOG WARNING: Aria storage engine requested on a non-MariaDB database.  Falling back to InnoDB', false, 'SYSLOG');

			$engine = 'InnoDB';
		}
	}

	// Partition retention days are required for partitioned table creation
	// regardless of how the options were supplied.  '0' is a valid value
	// (Indefinite retention) and must not be coerced.
	if (!isset($options['days']) || !is_numeric($options['days']) || (int) $options['days'] < 0) {
		$options['days'] = 30;
	}

	// set table construction settings for the remote pollers
	set_config_option('syslog_install_upgrade_type', empty($options['upgrade_type']) ? '' : $options['upgrade_type'], true);
	set_config_option('syslog_install_engine',       empty($options['engine']) ? '' : $options['engine'], true);
	set_config_option('syslog_install_db_type',      empty($options['db_type']) ? '' : $options['db_type'], true);
	set_config_option('syslog_install_days',         empty($options['days']) ? '' : $options['days'], true);

	if ($truncate) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog`");
	}

	// The syslog table is created partitioned; the helper also selects the
	// matching ROW_FORMAT for the chosen engine.
	syslog_create_partitioned_syslog_table($engine, $options['days'], read_config_option('syslog_partition_ahead_days'));

	if ($truncate) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_alert`");
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_alert` (
		`id` int(10) NOT NULL auto_increment,
		`hash` varchar(32) NOT NULL default '',
		`name` varchar(255) NOT NULL default '',
		`severity` int(10) UNSIGNED NOT NULL default '0',
		`method` int(10) unsigned NOT NULL default '0',
		`level` int(10) unsigned NOT NULL default '0',
		`num` int(10) unsigned NOT NULL default '1',
		`type` varchar(16) NOT NULL default '',
		`enabled` CHAR(2) default 'on',
		`repeat_alert` int(10) unsigned NOT NULL default '0',
		`cooldown_minutes` int(10) NOT NULL default '-1',
		`deduplication_minutes` int(10) NOT NULL default '-1',
		`suppression_schedule` text NOT NULL,
		`maintenance_mode` varchar(16) NOT NULL default 'inherit',
		`maintenance_days` varchar(32) NOT NULL default '1,2,3,4,5',
		`maintenance_start` char(5) NOT NULL default '00:00',
		`maintenance_end` char(5) NOT NULL default '00:00',
		`maintenance_datetime_start` varchar(16) NOT NULL default '',
		`maintenance_datetime_end` varchar(16) NOT NULL default '',
		`open_ticket` CHAR(2) default '',
		`message` TEXT NOT NULL,
		`body` VARCHAR(8192) NOT NULL default '',
		`user` varchar(32) NOT NULL default '',
		`date` int(16) NOT NULL default '0',
		`email` varchar(255) default NULL,
		`notify` int(10) unsigned NOT NULL default '0',
		`command` varchar(255) default NULL,
		`notes` varchar(255) default NULL,
		PRIMARY KEY (id))
		ENGINE=InnoDB");

	if ($truncate) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_incoming`");
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_incoming` (
		facility_id int(10) unsigned default NULL,
		priority_id int(10) unsigned default NULL,
		program varchar(40) default NULL,
		logtime TIMESTAMP NOT NULL DEFAULT '0000-00-00 00:00:00',
		host varchar(64) default NULL,
		message varchar(2048) NOT NULL DEFAULT '',
		seq bigint unsigned NOT NULL auto_increment,
		`status` tinyint(4) NOT NULL default '0',
		PRIMARY KEY (seq),
		INDEX program (program),
		INDEX `status` (`status`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_alert_suppression` (
		`alert_id` int(10) unsigned NOT NULL,
		`scope_key` varchar(255) NOT NULL,
		`dedup_hash` char(40) NOT NULL,
		`last_sent` int(10) unsigned NOT NULL default '0',
		PRIMARY KEY (`alert_id`, `scope_key`, `dedup_hash`),
		INDEX `last_sent` (`last_sent`))
		ENGINE=InnoDB");

	if ($truncate) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_remove`");
	}

	if (stripos($engine, 'aria') !== false) {
		$row_format = 'ROW_FORMAT=Page';
	} else {
		$row_format = 'ROW_FORMAT=Dynamic';
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_remove` (
		id int(10) NOT NULL auto_increment,
		`hash` varchar(32) NOT NULL default '',
		name varchar(255) NOT NULL default '',
		`type` varchar(16) NOT NULL default '',
		enabled CHAR(2) DEFAULT 'on',
		method CHAR(5) DEFAULT 'del',
		message TEXT NOT NULL,
		`user` varchar(32) NOT NULL default '',
		`date` int(16) NOT NULL default '0',
		notes varchar(255) default NULL,
		PRIMARY KEY (id))
		ENGINE=$engine
		$row_format");

	$present = syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog_reports'");

	if (cacti_sizeof($present)) {
		$newreport = syslog_db_column_exists('syslog_reports', 'body');
	} else {
		$newreport = true;
	}

	if ($truncate || !$newreport) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_reports`");
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_reports` (
		id int(10) NOT NULL auto_increment,
		`hash` varchar(32) NOT NULL default '',
		name varchar(255) NOT NULL default '',
		`type` varchar(16) NOT NULL default '',
		enabled CHAR(2) DEFAULT 'on',
		timespan int(16) NOT NULL default '0',
		timepart char(5) NOT NULL default '00:00',
		lastsent int(16) NOT NULL default '0',
		body varchar(8192) NOT NULL default '0',
		message varchar(2048) default NULL,
		`user` varchar(32) NOT NULL default '',
		`date` int(16) NOT NULL default '0',
		email varchar(255) default NULL,
		notify int(10) unsigned NOT NULL default '0',
		notes varchar(255) default NULL,
		PRIMARY KEY (id))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_saved_searches` (
		`id` int(10) NOT NULL auto_increment,
		`name` varchar(128) NOT NULL default '',
		`search` text NOT NULL,
		`removal` int(10) NOT NULL default '1',
		`grouping` int(10) NOT NULL default '0',
		`user` varchar(32) NOT NULL default '',
		`is_global` char(2) NOT NULL default '',
		`date` int(16) NOT NULL default '0',
		PRIMARY KEY (`id`),
		KEY owner (`user`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_status` (
		`name` varchar(64) NOT NULL default '',
		`value` text NOT NULL,
		`updated` int(16) NOT NULL default '0',
		PRIMARY KEY (`name`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	if ($truncate) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_hosts`");
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_programs` (
		`program_id` int(10) unsigned NOT NULL auto_increment,
		`program` VARCHAR(40) NOT NULL,
		`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
		PRIMARY KEY (`program`),
		INDEX host_id (`program_id`),
		INDEX last_updated (`last_updated`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic
		COMMENT='Contains all programs currently in the syslog table'");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_hosts` (
		`host_id` int(10) unsigned NOT NULL auto_increment,
		`host` VARCHAR(64) NOT NULL,
		`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
		PRIMARY KEY (`host`),
		INDEX host_id (`host_id`),
		INDEX last_updated (`last_updated`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic
		COMMENT='Contains all hosts currently in the syslog table'");

	syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_facilities`");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_facilities` (
		`facility_id` int(10) unsigned NOT NULL,
		`facility` varchar(10) NOT NULL,
		`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
		PRIMARY KEY  (`facility_id`),
		INDEX last_updated (`last_updated`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	syslog_db_execute("INSERT INTO `$syslogdb_default`.`syslog_facilities` (facility_id, facility) VALUES
		(0,'kern'), (1,'user'), (2,'mail'), (3,'daemon'), (4,'auth'), (5,'syslog'), (6,'lpd'), (7,'news'),
		(8,'uucp'), (9,'crond'), (10,'authpriv'), (11,'ftpd'), (12,'ntpd'), (13,'logaudit'), (14,'logalert'),
		(15,'crond'), (16,'local0'), (17,'local1'), (18,'local2'), (19,'local3'), (20,'local4'), (21,'local5'),
		(22,'local6'), (23,'local7')");

	syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_priorities`");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_priorities` (
		`priority_id` int(10) unsigned NOT NULL,
		`priority` varchar(10) NOT NULL,
		`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
		PRIMARY KEY (`priority_id`),
		INDEX last_updated (`last_updated`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	syslog_db_execute("INSERT INTO `$syslogdb_default`.`syslog_priorities` (priority_id, priority) VALUES
		(0,'emerg'), (1,'alert'), (2,'crit'), (3,'err'), (4,'warning'), (5,'notice'), (6,'info'), (7,'debug'), (8,'other')");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_host_facilities` (
		`host_id` int(10) unsigned NOT NULL,
		`facility_id` int(10) unsigned NOT NULL,
		`last_updated` TIMESTAMP NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
		PRIMARY KEY  (`host_id`,`facility_id`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	if ($truncate) {
		syslog_db_execute("DROP TABLE IF EXISTS `$syslogdb_default`.`syslog_removed`");
	}

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_removed` LIKE `$syslogdb_default`.`syslog`");

	syslog_db_execute("CREATE TABLE IF NOT EXISTS `$syslogdb_default`.`syslog_logs` (
		alert_id int(10) unsigned not null default '0',
		logseq bigint unsigned NOT NULL,
		logtime TIMESTAMP NOT NULL default '0000-00-00 00:00:00',
		logmsg varchar(1024) default NULL,
		host varchar(64) default NULL,
		facility_id int(10) unsigned default NULL,
		priority_id int(10) unsigned default NULL,
		program_id int(10) unsigned default NULL,
		count integer unsigned NOT NULL default '0',
		html blob default NULL,
		seq bigint unsigned NOT NULL auto_increment,
		PRIMARY KEY (seq),
		INDEX `logseq` (`logseq`),
		INDEX `program_id` (`program_id`),
		INDEX `alert_id` (`alert_id`),
		INDEX `host` (`host`),
		INDEX `logtime` (`logtime`),
		INDEX `priority_id` (`priority_id`),
		INDEX `facility_id` (`facility_id`))
		ENGINE=InnoDB
		ROW_FORMAT=Dynamic");

	if (!isset($settings['syslog'])) {
		syslog_config_settings();
	}

	foreach ($settings['syslog'] as $name => $values) {
		if (isset($values['default'])) {
			set_config_option($name, $values['default']);
		}
	}

	// ensure that the setting if set previously to truncate is switched to upgrade
	set_config_option('syslog_install_upgrade_type', 'upgrade');
}

/**
 * Replicate the Syslog rules tables to a remote data collector.
 *
 * @param array<string, mixed> $data The replication data provided by Cacti,
 *                                   containing the remote poller id, the remote
 *                                   connection id and the replication class.
 *
 * @return array<string, mixed> The replication data, unmodified.
 */
function syslog_replicate_out($data) {
	syslog_connect();

	if (read_config_option('syslog_remote_enabled') == 'on' && read_config_option('syslog_remote_sync_rules') == 'on') {
		$remote_poller_id = $data['remote_poller_id'];
		$rcnn_id          = $data['rcnn_id'];
		$class            = $data['class'];

		cacti_log('INFO: Replicating for the Syslog Plugin', false, 'REPLICATE');

		if ($class == 'all') {
			$tdata = syslog_db_fetch_assoc('SELECT * FROM syslog_alert');
			replicate_out_table($rcnn_id, $tdata, 'syslog_alert', $remote_poller_id);
			$tdata = syslog_db_fetch_assoc('SELECT * FROM syslog_remove');
			replicate_out_table($rcnn_id, $tdata, 'syslog_remove', $remote_poller_id);
			$tdata = syslog_db_fetch_assoc('SELECT * FROM syslog_reports');
			replicate_out_table($rcnn_id, $tdata, 'syslog_reports', $remote_poller_id);
		}
	}

	return $data;
}

/**
 * Pull the Syslog rules tables from the main Cacti database.
 *
 * @return void
 */
function syslog_replicate_in(): void {
	syslog_connect();

	if (read_config_option('syslog_remote_enabled') == 'on' && read_config_option('syslog_remote_sync_rules') == 'on') {
		$data = db_fetch_assoc('SELECT * FROM syslog_alert');
		syslog_replace_data('syslog_alert', $data);

		$data = db_fetch_assoc('SELECT * FROM syslog_remove');
		syslog_replace_data('syslog_remove', $data);

		$data = db_fetch_assoc('SELECT * FROM syslog_reports');
		syslog_replace_data('syslog_reports', $data);
	}
}

/**
 * Replace the data in the local table with the replicated data.
 *
 * @param string                           $table The name of the table to replace.
 * @param array<int, array<string, mixed>> $data  The replicated rows, passed by reference.
 *
 * @return void
 */
function syslog_replace_data($table, &$data) {
	if (cacti_sizeof($data)) {
		$sqlData    = [];
		$sqlQuery   = [];
		$columns    = array_keys($data[0]);
		$create_sql = '';

		$create = db_fetch_row('SHOW CREATE TABLE ' . $table);

		if (is_array($create)) {
			if (isset($create["CREATE TABLE `$table`"])) {
				$create_sql = $create["CREATE TABLE `$table`"];
			} elseif (isset($create['Create Table'])) {
				$create_sql = $create['Create Table'];
			}
		}

		if (!syslog_db_table_exists($table)) {
			if ($create_sql == '') {
				cacti_log('WARNING: Unable to derive CREATE TABLE SQL for `' . $table . '` during Syslog replication.', false, 'REPLICATE');

				return;
			}

			syslog_db_execute($create_sql);
			syslog_db_execute("TRUNCATE TABLE $table");
		}

		// Make the prefix
		$sql_prefix = "INSERT INTO $table (`" . implode('`,`', $columns) . '`) VALUES ';

		// Make the suffix
		$sql_suffix = ' ON DUPLICATE KEY UPDATE ';

		foreach ($columns as $c) {
			$sql_suffix .= " $c = VALUES($c),";
		}
		$sql_suffix = trim($sql_suffix, ',');

		// Construct the prepared statement
		foreach ($data as $row) {
			$sqlQuery[] = '(' . trim(str_repeat('?, ', cacti_sizeof($columns)), ', ') . ')';

			foreach ($row as $col) {
				$sqlData[] = $col;
			}
		}

		$sql = implode(', ', $sqlQuery);

		syslog_db_execute_prepared($sql_prefix . $sql . $sql_suffix, $sqlData);
	}
}

/**
 * Return the version information for the Syslog plugin.
 *
 * @return array<string, mixed> The 'info' section of the plugin INFO file, or an
 *                              empty array when the file cannot be parsed.
 */
function plugin_syslog_version(): array {
	global $config;
	$info = parse_ini_file($config['base_path'] . '/plugins/syslog/INFO', true);

	if (is_array($info) && isset($info['info']) && is_array($info['info'])) {
		return $info['info'];
	}

	return [];
}

/**
 * Check that the Syslog plugin dependencies are met.
 *
 * @return bool Always true, the Syslog plugin has no dependencies.
 */
function syslog_check_dependencies(): bool {
	return true;
}

/**
 * Poller bottom hook, launches the Syslog message processing process.
 *
 * @return void
 */
function syslog_poller_bottom(): void {
	global $config;

	if (syslog_config_safe()) {
		include_once(__DIR__ . '/functions.php');
		include_once(__DIR__ . '/database.php');

		syslog_connect();
		syslog_status_set('last_polling_time', time());

		$command_string = (string) read_config_option('path_php_binary');
		$extra_args     = ' -q ' . $config['base_path'] . '/plugins/syslog/syslog_process.php';
		exec_background($command_string, $extra_args);
	} else {
		cacti_log('WARNING: You have installed the Syslog plugin, but you have not properly set a config.php or config_local.php', false, 'POLLER');
	}
}

/**
 * Display the install/upgrade advisor form.
 *
 * @param int $syslog_exists Whether the Syslog table already exists.
 *
 * @return void
 */
function syslog_install_advisor(int $syslog_exists): void {
	global $config, $syslog_retentions;

	top_header();

	syslog_config_arrays();

	$fields_syslog_update = [
		'upgrade_type' => [
			'method'        => 'drop_array',
			'friendly_name' => __('What upgrade/install type do you wish to use', 'syslog'),
			'description'   => __('When you have very large tables, performing a Truncate will be much quicker.  If you are concerned about archive data, you can choose either Inline, which will freeze your browser for the period of this upgrade, or background, which will create a background process to bring your old syslog data from a backup table to the new syslog format.  Again this process can take several hours.', 'syslog'),
			'value'         => 'truncate',
			'array'         => [
				'truncate'   => __('Truncate Syslog Table', 'syslog'),
				'inline'     => __('Inline Upgrade', 'syslog'),
				'background' => __('Background Upgrade', 'syslog')
			]
		],
		'engine' => [
			'method'        => 'drop_array',
			'friendly_name' => __('Database Storage Engine', 'syslog'),
			'description'   => __('The storage engine for the analytical tables.  Only InnoDB and, on MariaDB, Aria storage engines are supported.', 'syslog'),
			'value'         => 'innodb',
			'array'         => [
				'innodb' => __('InnoDB Storage', 'syslog'),
				'aria'   => __('Aria Storage', 'syslog')
			]
		],
		'db_type' => [
			'method' => 'hidden',
			'value'  => 'part'
		],
		'days' => [
			'method'        => 'drop_array',
			'friendly_name' => __('Retention Policy', 'syslog'),
			'description'   => __('Choose how many days of Syslog values you wish to maintain in the database.', 'syslog'),
			'value'         => '30',
			'array'         => $syslog_retentions
		],
		'mode' => [
			'method' => 'hidden',
			'value'  => 'install'
		],
		'install' => [
			'method' => 'hidden',
			'value'  => 'true'
		],
		'id' => [
			'method' => 'hidden',
			'value'  => 'syslog'
		]
	];

	$fields_syslog_update['dayparts'] = [
		'method'        => 'drop_array',
		'friendly_name' => __('Partitions per Day', 'syslog'),
		'description'   => __('Select the number of partitions per day that you wish to create.', 'syslog'),
		'value'         => '1',
		'array'         => [
			'1'  => __('%d Per Day', 1, 'syslog'),
			'2'  => __('%d Per Day', 2, 'syslog'),
			'4'  => __('%d Per Day', 4, 'syslog'),
			'6'  => __('%d Per Day', 6, 'syslog'),
			'12' => __('%d Per Day', 12, 'syslog')
		]
	];

	if ($syslog_exists) {
		$type = __('Upgrade', 'syslog');
	} else {
		$type = __('Install', 'syslog');
	}

	syslog_connect();
	$database = syslog_db_fetch_row('SHOW GLOBAL VARIABLES LIKE "version"');

	// remove Aria as a storage engine if this is mysql
	if (stripos($database['Value'], 'mariadb') === false) {
		unset($fields_syslog_update['engine']['array']['aria']);
	} else {
		$fields_syslog_update['engine']['value'] = 'aria';
	}

	print "<table align='center' width='80%'><tr><td>";
	html_start_box(__('Syslog %s Advisor', $type, 'syslog'), '100%', '', '3', 'center', '');
	print '<tr><td>';

	if ($syslog_exists) {
		print "<h2 style='color:red;'>" . __('WARNING: Syslog Upgrade is Time Consuming!!!', 'syslog') . '</h2>';
		print '<p>' . __('The upgrade of the \'main\' syslog table can be a very time consuming process.  As such, it is recommended that you either reduce the size of your syslog table prior to upgrading, or choose the background option</p> <p>If you choose the background option, your legacy syslog table will be renamed, and a new syslog table will be created.  Then, an upgrade process will be launched in the background.  Again, this background process can quite a bit of time to complete.  However, your data will be preserved</p> <p>Regardless of your choice, all existing removal and alert rules will be maintained during the upgrade process.</p> <p>Press <b>\'Upgrade\'</b> to proceed with the upgrade, or <b>\'Cancel\'</b> to return to the Plugins menu.', 'syslog') . '</p></td></tr>';
	} else {
		unset($fields_syslog_update['upgrade_type']);
		print '<p>' . __('You have several options to choose from when installing Syslog.  The first is the Database Architecture.  Partitioned tables are the only supported architecture as they prevent the size of the tables from becoming excessive thus slowing queries.  Traditional non-partitioned tables are deprecated and are no longer offered for new installs.', 'syslog') . '</p><p>' . __('You can also set the database storage engine for the analytical tables syslog and syslog_remove.  Only the InnoDB storage engine and, on MariaDB, the Aria storage engine are supported.  If using MariaDB, we recommend the Aria Storage Engine as it is designed for analytical queries.', 'syslog') . '</p><p>' . __('You can also select the retention duration.  Please keep in mind that if you have several hosts logging to syslog, this table can become quite large.', 'syslog') . '</p></td></tr>';
	}
	html_end_box();

	print "<form id='syslog_install' action='plugins.php' method='get'>";

	html_start_box(__('Syslog %s Settings', $type, 'syslog'), '100%', '', '3', 'center', '');

	draw_edit_form([
		'config' => [],
		'fields' => inject_form_variables($fields_syslog_update, [])]
	);

	html_end_box();
	syslog_confirm_button('install', 'plugins.php', $syslog_exists);
	print '</td></tr></table>';

	bottom_footer();
	exit;
}

/**
 * Display the uninstall advisor form.
 *
 * @return void
 */
function syslog_uninstall_advisor(): void {
	global $config, $syslogdb_default;

	syslog_connect();

	$syslog_exists = sizeof(syslog_db_fetch_row("SHOW TABLES FROM `$syslogdb_default` LIKE 'syslog'"));

	top_header();

	$fields_syslog_update = [
		'uninstall_method' => [
			'method'        => 'drop_array',
			'friendly_name' => __('What uninstall method do you want to use?', 'syslog'),
			'description'   => __('When uninstalling syslog, you can remove everything, or only components, just in case you plan on re-installing in the future.', 'syslog'),
			'value'         => 'all',
			'array'         => ['all' => __('Remove Everything (Logs, Tables, Settings)', 'syslog'), 'syslog' => __('Syslog Data Only', 'syslog')],
		],
		'mode' => [
			'method' => 'hidden',
			'value'  => 'uninstall'
		],
		'uninstall' => [
			'method' => 'hidden',
			'value'  => 'true'
		],
		'id' => [
			'method' => 'hidden',
			'value'  => 'syslog'
		]
	];

	form_start('plugins.php');

	print "<table align='center' width='80%'><tr><td>";

	html_start_box(__('Syslog Uninstall Preferences', 'syslog'), '100%', '', '3', 'center', '');

	draw_edit_form([
		'config' => [],
		'fields' => inject_form_variables($fields_syslog_update, [])]
	);

	html_end_box();

	syslog_confirm_button('uninstall', 'plugins.php', $syslog_exists);

	print '</td></tr></table>';

	bottom_footer();
	exit;
}

/**
 * Display the confirm and cancel buttons for the install/uninstall forms.
 *
 * @param string $action        The action being confirmed, either 'install' or 'uninstall'.
 * @param string $cancel_url    The URL to load when the action is cancelled.
 * @param int    $syslog_exists Whether the Syslog table already exists.
 *
 * @return void
 */
function syslog_confirm_button(string $action, string $cancel_url, int $syslog_exists): void {
	if ($action == 'install') {
		if ($syslog_exists) {
			$value = __('Upgrade', 'syslog');
		} else {
			$value = __('Install', 'syslog');
		}
	} else {
		$value = __('Uninstall', 'syslog');
	}

	?>
	<table align='center' width='100%'>
		<tr>
			<td class='saveRow' align='right'>
				<input id='<?php print ($syslog_exists ? 'return' : 'cancel')?>' type='button' value='<?php print __('Cancel', 'syslog'); ?>'>
				<input id='<?php print $action; ?>' type='submit' value='<?php print $value; ?>'>
				<script type='text/javascript'>
				$(function() {
					$('#syslog_install').submit(function(event) {
						event.preventDefault();

						/* set the URL */
						var strURL = $(this).attr('action');
						strURL += (strURL.indexOf('?') >= 0 ? '&':'?') + 'header=false';

						/* ensure that the csrf magic is appended */
						var json = $(this).serializeObject();
						json.__csrf_magic = csrfMagicToken;

						if (typeof postUrl == 'function') {
							postUrl({url: strURL}, json);
						} else {
							loadPageUsingPost(strURL, json);
						}
					});

					$('#cancel, #return').click(function() {
						loadPageNoHeader('plugins.php?header=false');
					});
				});
				</script>
			</td>
		</tr>
	</table>
	</form>
	<?php
}

/**
 * Register the Syslog settings in the Cacti settings table.
 *
 * @return void
 */
function syslog_alert_maintenance_time_options(): array {
	$options = [];
	for ($hour = 0; $hour < 24; $hour++) {
		foreach ([0, 30] as $minute) {
			$value = sprintf('%02d:%02d', $hour, $minute);
			$options[$value] = $value;
		}
	}

	return $options;
}

function syslog_alert_maintenance_day_options(bool $include_disabled = false): array {
	$options = [
		'1' => __('Monday', 'syslog'), '2' => __('Tuesday', 'syslog'), '3' => __('Wednesday', 'syslog'),
		'4' => __('Thursday', 'syslog'), '5' => __('Friday', 'syslog'), '6' => __('Saturday', 'syslog'), '7' => __('Sunday', 'syslog'),
		'1,2,3,4,5' => __('Monday through Friday', 'syslog'), '6,7' => __('Saturday and Sunday', 'syslog'),
		'1,2,3,4,5,6,7' => __('Every day', 'syslog')
	];

	return $include_disabled ? ['0' => __('Disabled', 'syslog')] + $options : $options;
}

function syslog_config_settings(): void {
	global $config, $tabs, $formats, $settings, $syslog_retentions, $syslog_alert_retentions, $syslog_refresh;

	include_once($config['base_path'] . '/lib/reports.php');

	if (get_nfilter_request_var('tab') == 'syslog') {
		$formats = reports_get_format_files();
	} elseif (empty($formats)) {
		$formats = [];
	}

	$tabs['syslog'] = __('Syslog', 'syslog');

	$temp = [
		'syslog_header' => [
			'friendly_name' => __('General Settings', 'syslog'),
			'method'        => 'spacer',
		],
		'syslog_enabled' => [
			'friendly_name' => __('Syslog Enabled', 'syslog'),
			'description'   => __('If this checkbox is set, records will be transferred from the Syslog Incoming table to the main syslog table and Alerts and Reports will be enabled.  Please keep in mind that if the system is disabled log entries will still accumulate into the Syslog Incoming table as this is defined by the rsyslog or syslog-ng process.', 'syslog'),
			'method'        => 'checkbox',
			'default'       => 'on'
		],
		'syslog_domains' => [
			'friendly_name' => __('Strip Domains', 'syslog'),
			'description'   => __('A comma delimited list of domains that you wish to remove from the syslog hostname, Examples would be \'mydomain.com, otherdomain.com\'', 'syslog'),
			'method'        => 'textbox',
			'default'       => '',
			'size'          => 80,
			'max_length'    => 255,
		],
		'syslog_refresh' => [
			'friendly_name' => __('Refresh Interval', 'syslog'),
			'description'   => __('This is the time in seconds before the page refreshes.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '300',
			'array'         => $syslog_refresh
		],
		'syslog_maxrecords' => [
			'friendly_name' => __('Max Report Records', 'syslog'),
			'description'   => __('For Threshold based Alerts, what is the maximum number that you wish to show in the report.  This is used to limit the size of the html log and Email.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '100',
			'array'         => [
				20  => __('%d Records', 20, 'syslog'),
				40  => __('%d Records', 40, 'syslog'),
				60  => __('%d Records', 60, 'syslog'),
				100 => __('%d Records', 100, 'syslog'),
				200 => __('%d Records', 200, 'syslog'),
				400 => __('%d Records', 400, 'syslog')
			]
		],
		'syslog_max_workers' => [
			'friendly_name' => __('Maximum Syslog Processing Processes', 'syslog'),
			'description'   => __('When set above 1, incoming message processing is spread across parallel worker processes.  Each worker handles a disjoint range of incoming messages, speeding up hostname resolution and message transfer under heavy loads.  A setting of 1 processes all messages in a single process.  Worker processes are not supported on Windows or when the PHP pcntl and POSIX extensions are unavailable, in which case processing falls back to a single process.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '1',
			'array'         => [
				1  => __('%d Worker Process', 1, 'syslog'),
				2  => __('%d Worker Processes', 2, 'syslog'),
				4  => __('%d Worker Processes', 4, 'syslog'),
				6  => __('%d Worker Processes', 6, 'syslog'),
				8  => __('%d Worker Processes', 8, 'syslog'),
				16 => __('%d Worker Processes', 16, 'syslog')
			]
		],
		'syslog_ticket_command' => [
			'friendly_name' => __('Command for Opening Tickets', 'syslog'),
			'description'   => __('This command will be executed for opening Help Desk Tickets.  The command will be required to parse multiple input parameters as follows: <b>--alert-name</b>, <b>--severity</b>, <b>--hostlist</b>, <b>--message</b>.  The hostlist will be a comma delimited list of hosts impacted by the alert.', 'syslog'),
			'method'        => 'textbox',
			'max_length'    => 255,
			'size'          => 80
		],
		'syslog_html_header' => [
			'friendly_name' => __('Host Discovery Options', 'syslog'),
			'method'        => 'spacer',
			'collapsible'   => 'true'
		],
		'syslog_resolve_hostname' => [
			'friendly_name' => __('Enable Hostname Resolution', 'syslog'),
			'description'   => __('If this checkbox is set, all hostnames are resolved via DNS lookup first (If enabled). If the DNS lookup fails, the system will attempt to resolve the hostname against the Cacti host table and replace it with the Cacti host description. If both DNS and Cacti lookups fail, records are assigned a prefix \'unresolved-Original_hostname\'.', 'syslog'),
			'method'        => 'checkbox',
			'default'       => ''
		],
		'syslog_no_dns' => [
			'friendly_name' => __('Skip DNS Resolution for incoming hosts', 'syslog'),
			'description'   => __('If this checkbox is set, the system will not attempt to resolve hosts via DNS lookups.  This is useful for environments where DNS resolution is not possible or not desired.', 'syslog'),
			'method'        => 'checkbox',
			'default'       => ''
		],
		'syslog_html_notification_header' => [
			'friendly_name' => __('HTML Notification Settings', 'syslog'),
			'method'        => 'spacer',
			'collapsible'   => 'true'
		],
		'syslog_html' => [
			'friendly_name' => __('Enable HTML Based Email', 'syslog'),
			'description'   => __('If this checkbox is set, all Emails will be sent in HTML format.  Otherwise, Emails will be sent in plain text.', 'syslog'),
			'method'        => 'checkbox',
			'default'       => 'on'
		],
		'syslog_format_file' => [
			'friendly_name' => __('Format File to Use', 'syslog'),
			'method'        => 'drop_array',
			'default'       => 'default.format',
			'description'   => __('Choose the custom html wrapper and CSS file to use.  This file contains both html and CSS to wrap around your report.  If it contains more than simply CSS, you need to place a special <REPORT> tag inside of the file.  This format tag will be replaced by the report content.  These files are located in the \'formats\' directory.', 'syslog'),
			'array'         => $formats
		],
		'syslog_retention_header' => [
			'friendly_name' => __('Data Retention Settings', 'syslog'),
			'method'        => 'spacer',
			'collapsible'   => 'true'
		],
		'syslog_retention' => [
			'friendly_name' => __('Syslog Retention', 'syslog'),
			'description'   => __('This is the number of days to keep events.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '30',
			'array'         => $syslog_retentions
		],
		'syslog_partition_ahead_days' => [
			'friendly_name' => __('Partition Pre-create Window', 'syslog'),
			'description'   => __('This is the number of future daily partitions to maintain for partitioned Syslog tables.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '3',
			'array'         => [
				'1' => __('%d Day', 1, 'syslog'),
				'2' => __('%d Days', 2, 'syslog'),
				'3' => __('%d Days', 3, 'syslog'),
				'4' => __('%d Days', 4, 'syslog'),
				'5' => __('%d Days', 5, 'syslog'),
				'6' => __('%d Days', 6, 'syslog'),
				'7' => __('%d Days', 7, 'syslog')
			]
		],
		'syslog_partition_recover_limit' => [
			'friendly_name' => __('Partition Recovery Limit', 'syslog'),
			'description'   => __('When partitions are missing (for example after maintenance downtime), at most this many missing partitions per table are created on each poller run.  The remaining gap heals over subsequent runs; retention pruning stays deferred until the future partition horizon is fully restored.  Applies to partitioned Syslog tables only.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '3',
			'array'         => [
				'1'  => __('%d Partition per run', 1, 'syslog'),
				'2'  => __('%d Partitions per run', 2, 'syslog'),
				'3'  => __('%d Partitions per run', 3, 'syslog'),
				'5'  => __('%d Partitions per run', 5, 'syslog'),
				'10' => __('%d Partitions per run', 10, 'syslog'),
				'31' => __('%d Partitions per run', 31, 'syslog')
			]
		],
		'syslog_stale_threshold' => [
			'friendly_name' => __('Collector Staleness Threshold', 'syslog'),
			'description'   => __('The Syslog Status page shows a warning when no new message has arrived within this many seconds.  Set to 0 to use the default of 300 seconds.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '300',
			'array'         => [
				'0'    => __('Default (300 seconds)', 'syslog'),
				'120'  => __('%d seconds', 120, 'syslog'),
				'300'  => __('%d seconds', 300, 'syslog'),
				'600'  => __('%d seconds', 600, 'syslog'),
				'1800' => __('%d seconds', 1800, 'syslog'),
				'3600' => __('%d seconds', 3600, 'syslog')
			]
		],
		'syslog_backlog_threshold' => [
			'friendly_name' => __('Collector Backlog Threshold', 'syslog'),
			'description'   => __('The Syslog Status page shows a warning when more than this many messages sit unprocessed in the Syslog Incoming table.  Set to 0 to use the default of 10000 messages.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '10000',
			'array'         => [
				'0'     => __('Default (10000 messages)', 'syslog'),
				'1000'  => __('%d Messages', 1000, 'syslog'),
				'5000'  => __('%d Messages', 5000, 'syslog'),
				'10000' => __('%d Messages', 10000, 'syslog'),
				'50000' => __('%d Messages', 50000, 'syslog')
			]
		],
		'syslog_alert_retention' => [
			'friendly_name' => __('Syslog Alert Retention', 'syslog'),
			'description'   => __('This is the number of days to keep alert logs.', 'syslog'),
			'method'        => 'drop_array',
			'default'       => '30',
			'array'         => $syslog_alert_retentions
		],
		'syslog_alert_suppression_header' => [
			'friendly_name' => __('Alert Suppression and Maintenance', 'syslog'),
			'method'        => 'spacer',
			'collapsible'   => 'true'
		],
		'syslog_alert_maintenance_days' => [
			'friendly_name' => __('Maintenance Window Days', 'syslog'),
			'description'   => __('Days when all alert notifications are muted during the configured maintenance timeframe.', 'syslog'),
			'method'        => 'drop_array',
			'array'         => syslog_alert_maintenance_day_options(true),
			'default'       => '0'
		],
		'syslog_alert_maintenance_start' => [
			'friendly_name' => __('Maintenance Window Starts', 'syslog'),
			'description'   => __('Local start time for the global maintenance window.', 'syslog'),
			'method'        => 'drop_array',
			'array'         => syslog_alert_maintenance_time_options(),
			'default'       => '00:00'
		],
		'syslog_alert_maintenance_end' => [
			'friendly_name' => __('Maintenance Window Ends', 'syslog'),
			'description'   => __('Local end time for the global maintenance window. An earlier end time continues into the next day.', 'syslog'),
			'method'        => 'drop_array',
			'array'         => syslog_alert_maintenance_time_options(),
			'default'       => '00:00'
		],
		'syslog_alert_maintenance_datetime_start' => [
			'friendly_name' => __('One-time Maintenance Starts', 'syslog'),
			'description'   => __('Optional local date and time to start a one-time global maintenance window.', 'syslog'),
			'method'        => 'textbox', 'size' => '18', 'max_length' => '16', 'default' => ''
		],
		'syslog_alert_maintenance_datetime_end' => [
			'friendly_name' => __('One-time Maintenance Ends', 'syslog'),
			'description'   => __('Optional local date and time to end a one-time global maintenance window. Format: YYYY-MM-DD HH:MM.', 'syslog'),
			'method'        => 'textbox', 'size' => '18', 'max_length' => '16', 'default' => ''
		],
		'syslog_alert_cooldown_minutes' => [
			'friendly_name' => __('Default Alert Cooldown', 'syslog'),
			'description'   => __('Suppress any repeat notification for the same rule and reporting scope for this many minutes. Per-rule values override this setting. Set to 0 to disable.', 'syslog'),
			'method'        => 'textbox',
			'size'          => '6',
			'max_length'    => '6',
			'default'       => '0'
		],
		'syslog_alert_deduplication_minutes' => [
			'friendly_name' => __('Default Duplicate Suppression', 'syslog'),
			'description'   => __('Suppress a notification with the same matched message set for this many minutes. Per-rule values override this setting. Set to 0 to disable.', 'syslog'),
			'method'        => 'textbox',
			'size'          => '6',
			'max_length'    => '6',
			'default'       => '0'
		],
		'syslog_remote_header' => [
			'friendly_name' => __('Remote Message Processing', 'syslog'),
			'method'        => 'spacer',
		],
		'syslog_remote_enabled' => [
			'friendly_name' => __('Enable Remote Data Collector Message Processing', 'syslog'),
			'description'   => __('If your Remote Data Collectors have their own Syslog databases and process their messages independently, check this checkbox.  By checking this Checkbox, your Remote Data Collectors will need to maintain their own \'config_local.php\' file in order to inform Syslog to use an independent database for message display and processing.  Please use the template file \'config_local.php.dist\' for this purpose.  WARNING: Syslog tables will be automatically created as soon as this option is enabled.', 'syslog'),
			'method'        => 'checkbox',
			'default'       => ''
		],
		'syslog_remote_sync_rules' => [
			'friendly_name' => __('Remote Data Collector Rules Sync', 'syslog'),
			'description'   => __('If your Remote Data Collectors have their own Syslog databases and process thrie messages independently, check this checkbox if you wish the Main Cacti databases Alerts, Removal and Report rules to be sent to the Remote Cacti System.', 'syslog'),
			'method'        => 'checkbox',
			'default'       => ''
		],
	];

	if (isset($settings['syslog'])) {
		$settings['syslog'] = array_merge($settings['syslog'], $temp);
	} else {
		$settings['syslog'] = $temp;
	}
}

/** Attach Cacti's date-time picker after the Syslog Settings form is drawn. */
function syslog_settings_bottom(): void {
	if (get_nfilter_request_var('tab') !== 'syslog') {
		return;
	}
	?>
	<script type='text/javascript'>
	$(function() {
		$('#syslog_alert_maintenance_datetime_start, #syslog_alert_maintenance_datetime_end').datetimepicker({
			minuteGrid: 10,
			stepMinute: 1,
			showAnim: 'slideDown',
			numberOfMonths: 1,
			timeFormat: 'HH:mm',
			dateFormat: 'yy-mm-dd',
			showButtonPanel: false
		});
	});
	</script>
	<?php
}

/**
 * Return the refresh value for the top graph tabs.
 *
 * @param mixed $refresh The refresh interval provided by Cacti or a prior plugin hook.
 *
 * @return mixed The refresh interval, unmodified.
 */
function syslog_top_graph_refresh($refresh) {
	return $refresh;
}

/**
 * Draw the Syslog tab in the top header.
 *
 * @return void
 */
function syslog_show_tab(): void {
	global $config;

	if (!syslog_config_safe()) {
		return;
	}

	if (api_user_realm_auth('syslog.php')) {
		if (substr_count($_SERVER['REQUEST_URI'], 'syslog.php')) {
			print '<a href="' . $config['url_path'] . 'plugins/syslog/syslog.php"><img src="' . $config['url_path'] . 'plugins/syslog/images/tab_syslog_down.gif" alt="' . __('Syslog', 'syslog') . '"></a>';
		} else {
			print '<a href="' . $config['url_path'] . 'plugins/syslog/syslog.php"><img src="' . $config['url_path'] . 'plugins/syslog/images/tab_syslog.gif" alt="' . __('Syslog', 'syslog') . '"></a>';
		}
	}
}

/**
 * Determine which Syslog config file is present, and if it is for a remote database.
 *
 * @return void
 */
function syslog_determine_config(): void {
	global $config;

	// Setup the syslog database settings path
	if (!defined('SYSLOG_CONFIG')) {
		if (file_exists(__DIR__ . '/config_local.php')) {
			define('SYSLOG_CONFIG', __DIR__ . '/config_local.php');
			$config['syslog_remote_db'] = true;
		} elseif (file_exists(__DIR__ . '/config.php')) {
			define('SYSLOG_CONFIG', __DIR__ . '/config.php');
			$config['syslog_remote_db'] = false;
		}
	}
}

/**
 * Check that either Syslog config file exists and is readable.
 *
 * @return bool True when a Syslog config file is available, false otherwise.
 */
function syslog_config_safe(): bool {
	global $config;

	$files = [
		__DIR__ . '/config_local.php',
		__DIR__ . '/config.php'
	];

	foreach ($files as $file) {
		if (file_exists($file) && is_readable($file)) {
			return true;
		}
	}

	return false;
}

/**
 * Setup the Syslog specific global arrays used throughout the plugin.
 *
 * @return void
 */
function syslog_config_arrays(): void {
	global $syslog_actions, $config, $menu, $message_types, $severities, $messages;
	global $syslog_levels, $syslog_facilities, $syslog_freqs, $syslog_times, $syslog_refresh;
	global $syslog_retentions, $syslog_alert_retentions, $menu_glyphs;

	$syslog_actions = [
		1 => __('Delete', 'syslog'),
		2 => __('Disable', 'syslog'),
		3 => __('Enable', 'syslog'),
		4 => __('Export', 'syslog')
	];

	$syslog_levels = [
		0 => 'emerg',
		1 => 'crit',
		2 => 'alert',
		3 => 'err',
		4 => 'warn',
		5 => 'notice',
		6 => 'info',
		7 => 'debug',
		8 => 'other'
	];

	$syslog_facilities = [
		0  => 'kernel',
		1  => 'user',
		2  => 'mail',
		3  => 'daemon',
		4  => 'auth',
		5  => 'syslog',
		6  => 'lpr',
		7  => 'news',
		8  => 'uucp',
		9  => 'cron',
		10 => 'authpriv',
		11 => 'ftp',
		12 => 'ntp',
		13 => 'log audit',
		14 => 'log alert',
		15 => 'cron',
		16 => 'local0',
		17 => 'local1',
		18 => 'local2',
		19 => 'local3',
		20 => 'local4',
		21 => 'local5',
		22 => 'local6',
		23 => 'local7'
	];

	$syslog_retentions = [
		'0'   => __('Indefinite', 'syslog'),
		'1'   => __('%d Day', 1, 'syslog'),
		'2'   => __('%d Days', 2, 'syslog'),
		'3'   => __('%d Days', 3, 'syslog'),
		'4'   => __('%d Days', 4, 'syslog'),
		'5'   => __('%d Days', 5, 'syslog'),
		'6'   => __('%d Days', 6, 'syslog'),
		'7'   => __('%d Week', 1, 'syslog'),
		'14'  => __('%d Weeks', 2, 'syslog'),
		'30'  => __('%d Month', 1, 'syslog'),
		'60'  => __('%d Months', 2, 'syslog'),
		'90'  => __('%d Months', 3, 'syslog'),
		'120' => __('%d Months', 4, 'syslog'),
		'160' => __('%d Months', 5, 'syslog'),
		'183' => __('%d Months', 6, 'syslog'),
		'365' => __('%d Year', 1, 'syslog')
	];

	$syslog_alert_retentions = [
		'0'   => __('Indefinite', 'syslog'),
		'1'   => __('%d Day', 1, 'syslog'),
		'2'   => __('%d Days', 2, 'syslog'),
		'3'   => __('%d Days', 3, 'syslog'),
		'4'   => __('%d Days', 4, 'syslog'),
		'5'   => __('%d Days', 5, 'syslog'),
		'6'   => __('%d Days', 6, 'syslog'),
		'7'   => __('%d Week', 1, 'syslog'),
		'14'  => __('%d Weeks', 2, 'syslog'),
		'30'  => __('%d Month', 1, 'syslog'),
		'60'  => __('%d Months', 2, 'syslog'),
		'90'  => __('%d Months', 3, 'syslog'),
		'120' => __('%d Months', 4, 'syslog'),
		'160' => __('%d Months', 5, 'syslog'),
		'183' => __('%d Months', 6, 'syslog'),
		'365' => __('%d Year', 1, 'syslog')
	];

	$syslog_refresh = [
		9999999 => __('Never', 'syslog'),
		'60'    => __('%d Minute', 1, 'syslog'),
		'120'   => __('%d Minutes', 2, 'syslog'),
		'300'   => __('%d Minutes', 5, 'syslog'),
		'600'   => __('%d Minutes', 10, 'syslog')
	];

	$severities = [
		'0' => __('Notice', 'syslog'),
		'1' => __('Warning', 'syslog'),
		'2' => __('Critical', 'syslog')
	];

	$message_types = [
		'messageb' => __('Begins with', 'syslog'),
		'messagec' => __('Contains', 'syslog'),
		'messagee' => __('Ends with', 'syslog'),
		'host'     => __('Hostname is', 'syslog'),
		'program'  => __('Program is', 'syslog'),
		'facility' => __('Facility is', 'syslog'),
		'filter'   => __('Filter Builder', 'syslog'),
		'sql'      => __('SQL Expression', 'syslog')
	];

	$syslog_freqs = [
		'86400'  => __('Daily', 'syslog'),
		'604800' => __('Weekly', 'syslog')
	];

	for ($i = 0; $i <= 86400; $i += 1800) {
		$minute = $i % 3600;

		if ($minute > 0) {
			$minute = '30';
		} else {
			$minute = '00';
		}

		if ($i > 0) {
			$hour = strrev(substr(strrev('00' . intval($i / 3600)),0,2));
		} else {
			$hour = '00';
		}

		$syslog_times[$i] = $hour . ':' . $minute;
	}

	if (syslog_config_safe()) {
		$menu2 =  [];

		foreach ($menu as $temp => $temp2) {
			$menu2[$temp] = $temp2;

			if ($temp == __('Import/Export')) {
				$menu2[__('Syslog Settings', 'syslog')]['plugins/syslog/syslog_alerts.php']  = __('Alert Rules', 'syslog');
				$menu2[__('Syslog Settings', 'syslog')]['plugins/syslog/syslog_device_rules.php'] = __('Device Alert Rules', 'syslog');
				$menu2[__('Syslog Settings', 'syslog')]['plugins/syslog/syslog_removal.php'] = __('Removal Rules', 'syslog');
				$menu2[__('Syslog Settings', 'syslog')]['plugins/syslog/syslog_reports.php'] = __('Report Rules', 'syslog');
				$menu2[__('Syslog Settings', 'syslog')]['plugins/syslog/syslog_saved_searches.php'] = __('Saved Search Templates', 'syslog');
				$menu2[__('Syslog Settings', 'syslog')]['plugins/syslog/syslog_dashboards.php'] = __('Dashboards', 'syslog');
			}
		}
		$menu = $menu2;

		$menu_glyphs[__('Syslog Settings', 'syslog')] = 'fa fa-life-ring';
	}

	syslog_refresh_permission_roles();

	if (isset($_SESSION['syslog_info']) && $_SESSION['syslog_info'] != '') {
		$messages['syslog_info'] = ['message' => $_SESSION['syslog_info'], 'type' => 'info'];
	}

	if (isset($_SESSION['syslog_error']) && $_SESSION['syslog_error'] != '') {
		$messages['syslog_error'] = ['message' => $_SESSION['syslog_error'], 'type' => 'error'];
	}
}

/**
 * Add the Syslog pages to the Cacti navigation structure.
 *
 * @param array<string, array<string, mixed>> $nav The navigation array provided by Cacti.
 *
 * @return array<string, array<string, mixed>> The navigation array with the Syslog pages added.
 */
function syslog_draw_navigation_text($nav) {
	global $config;

	$nav['syslog.php:']                = ['title' => __('Syslog', 'syslog'), 'mapping' => '', 'url' => $config['url_path'] . 'plugins/syslog/syslog.php', 'level' => '1'];
	$nav['syslog_removal.php:']        = ['title' => __('Syslog Removals', 'syslog'), 'mapping' => 'index.php:', 'url' => $config['url_path'] . 'plugins/syslog/syslog_removal.php', 'level' => '1'];
	$nav['syslog_removal.php:edit']    = ['title' => __('(Edit)', 'syslog'), 'mapping' => 'index.php:,syslog_removal.php:', 'url' => 'syslog_removal.php', 'level' => '2'];
	$nav['syslog_removal.php:newedit'] = ['title' => __('(Edit)', 'syslog'), 'mapping' => 'index.php:,syslog_removal.php:', 'url' => 'syslog_removal.php', 'level' => '2'];
	$nav['syslog_removal.php:actions'] = ['title' => __('(Actions)', 'syslog'), 'mapping' => 'index.php:,syslog_removal.php:', 'url' => 'syslog_removal.php', 'level' => '2'];

	$nav['syslog_alerts.php:']         = ['title' => __('Syslog Alerts', 'syslog'), 'mapping' => 'index.php:', 'url' => $config['url_path'] . 'plugins/syslog/syslog_alerts.php', 'level' => '1'];
	$nav['syslog_alerts.php:edit']     = ['title' => __('(Edit)', 'syslog'), 'mapping' => 'index.php:,syslog_alerts.php:', 'url' => 'syslog_alerts.php', 'level' => '2'];
	$nav['syslog_alerts.php:newedit']  = ['title' => __('(Edit)', 'syslog'), 'mapping' => 'index.php:,syslog_alerts.php:', 'url' => 'syslog_alerts.php', 'level' => '2'];
	$nav['syslog_alerts.php:actions']  = ['title' => __('(Actions)', 'syslog'), 'mapping' => 'index.php:,syslog_alerts.php:', 'url' => 'syslog_alerts.php', 'level' => '2'];

	$nav['syslog_reports.php:']        = ['title' => __('Syslog Reports', 'syslog'), 'mapping' => 'index.php:', 'url' => $config['url_path'] . 'plugins/syslog/syslog_reports.php', 'level' => '1'];
	$nav['syslog_reports.php:edit']    = ['title' => __('(Edit)', 'syslog'), 'mapping' => 'index.php:,syslog_reports.php:', 'url' => 'syslog_reports.php', 'level' => '2'];
	$nav['syslog_reports.php:actions'] = ['title' => __('(Actions)', 'syslog'), 'mapping' => 'index.php:,syslog_reports.php:', 'url' => 'syslog_reports.php', 'level' => '2'];
	$nav['syslog_saved_searches.php:'] = ['title' => __('Saved Search Templates', 'syslog'), 'mapping' => 'index.php:', 'url' => $config['url_path'] . 'plugins/syslog/syslog_saved_searches.php', 'level' => '1'];
	$nav['syslog_dashboards.php:']     = ['title' => __('Dashboards', 'syslog'), 'mapping' => 'index.php:', 'url' => $config['url_path'] . 'plugins/syslog/syslog_dashboards.php', 'level' => '1'];
	$nav['syslog.php:actions']         = ['title' => __('Syslog', 'syslog'), 'mapping' => '', 'url' => $config['url_path'] . 'plugins/syslog/syslog.php', 'level' => '1'];

	return $nav;
}

/**
 * Upgrade the Syslog database when the plugin config is loaded.
 *
 * @return void
 */
function syslog_config_insert(): void {
	if (!syslog_config_safe()) {
		return;
	}

	syslog_connect();

	syslog_check_upgrade();
}

/**
 * Display a link to the Syslog page filtered for the graphed device.
 *
 * @param array<int, array<string, mixed>> $graph_elements The graph elements provided by Cacti.
 *
 * @return void
 */
function syslog_graph_buttons($graph_elements = []): void {
	global $config, $timespan, $graph_timeshifts;

	if (!syslog_config_safe()) {
		return;
	}

	syslog_connect();

	if (get_nfilter_request_var('action') == 'view') {
		return;
	}

	if (get_current_page() == 'graph_view.php') {
		if (isset_request_var('graph_end') && strlen(get_filter_request_var('graph_end'))) {
			$date1 = date('Y-m-d H:i:s', get_filter_request_var('graph_start'));
			$date2 = date('Y-m-d H:i:s', get_filter_request_var('graph_end'));
		} else {
			$date1 = $timespan['current_value_date1'];
			$date2 = $timespan['current_value_date2'];
		}
	} else {
		return;
	}

	if (isset($graph_elements[1]['local_graph_id'])) {
		$host_id = db_fetch_cell_prepared('SELECT host_id
			FROM graph_local
			WHERE id = ?',
			[$graph_elements[1]['local_graph_id']]);

		$sql_where   = '';
		$sql_params  = [];

		if (!empty($host_id)) {
			$host  = db_fetch_row_prepared('SELECT id, description, hostname
				FROM host WHERE id = ?',
				[$host_id]);

			if (is_array($host) && cacti_sizeof($host)) {
				if (!is_ipaddress($host['description'])) {
					$parts     = explode('.', $host['description']);

					$sql_where = 'WHERE host LIKE ? OR host = ?';

					$sql_params[] = $parts[0] . '.%';
					$sql_params[] = $host['description'];
				} else {
					$sql_where = 'WHERE host = ?';

					$sql_params[] = $host['description'];
				}

				if (!is_ipaddress($host['hostname'])) {
					$parts = explode('.', $host['hostname']);

					$sql_where .= ($sql_where != '' ? ' OR ' : 'WHERE ') . 'host LIKE ? OR host = ?';

					$sql_params[] = $parts[0] . '.%';
					$sql_params[] = $host['hostname'];
				} else {
					$sql_where .= ($sql_where != '' ? ' OR ' : 'WHERE ') . 'host = ?';

					$sql_params[] = $host['hostname'];
				}

				if ($sql_where != '') {
					$host_id = syslog_db_fetch_cell_prepared('SELECT host_id FROM syslog_hosts ' . $sql_where, $sql_params);

					if ($host_id) {
						$url = $config['url_path'] . 'plugins/syslog/syslog.php?tab=syslog&reset=1&host=' . $host_id . '&date1=' . $date1 . '&date2=' . $date2;

						print "<a class='iconLink' href='" . htmlspecialchars($url, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . "' title='" . htmlspecialchars(__('Display Syslog in Range', 'syslog'), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8') . "'><i class='deviceRecovering fas fa-exclamation-triangle'></i></a><br>";
					}
				}
			}
		}
	}
}

/**
 * Handle the Syslog utilities actions.
 *
 * @param string $action The action requested from the utilities page.
 *
 * @return string|void The action, unmodified when it is not a Syslog action, or
 *                     nothing when the Syslog config file is not available.
 */
function syslog_utilities_action($action) {
	global $config, $refresh;

	if (!syslog_config_safe()) {
		return;
	}

	if ($action === 'purge_syslog_hosts') {
		if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
			cacti_log('WARNING: syslog purge blocked -- non-POST request', false, 'SYSLOG');
			raise_message('syslog_method_error', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR);
			header('Location: utilities.php?header=false');
			exit;
		}

		// csrf_check($fatal) returns bool; $fatal=false tells the helper not to
		// die/exit on failure so we can log and redirect with a user-visible
		// message ourselves.
		if (!function_exists('csrf_check')) {
			cacti_log('WARNING: syslog purge blocked -- CSRF validation unavailable', false, 'SYSLOG');
			raise_message('syslog_csrf_unavailable', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR);
			header('Location: utilities.php?header=false');
			exit;
		}

		if (!csrf_check(false)) {
			cacti_log('WARNING: syslog purge blocked -- CSRF token validation failed', false, 'SYSLOG');
			raise_message('syslog_csrf_error', __('Invalid request. Please try again.', 'syslog'), MESSAGE_LEVEL_ERROR);
			header('Location: utilities.php?header=false');
			exit;
		}

		$records = 0;

		syslog_db_execute('DELETE FROM syslog_hosts
			WHERE host_id NOT IN (
				SELECT DISTINCT host_id
				FROM syslog
				UNION
				SELECT DISTINCT host_id
				FROM syslog_removed
			)');
		$records += syslog_db_affected_rows();

		syslog_db_execute('DELETE FROM syslog_host_facilities
			WHERE host_id NOT IN (
				SELECT DISTINCT host_id
				FROM syslog
				UNION
				SELECT DISTINCT host_id
				FROM syslog_removed
			)');
		$records += syslog_db_affected_rows();

		raise_message('syslog_info', __('There were %s Device records removed from the Syslog database', $records, 'syslog'), MESSAGE_LEVEL_INFO);

		header('Location: utilities.php?header=false');
		exit;
	}

	return $action;
}

/**
 * Add the Syslog purge utility to the utilities page.
 *
 * @return void
 */
function syslog_utilities_list(): void {
	global $config;

	if (!syslog_config_safe()) {
		return;
	}

	html_header([__('Syslog Utilities', 'syslog')], 2); ?>

	<tr class='even'>
		<td>
			<input id='syslog_purge_hosts' type='button' value='<?php print __esc('Purge Syslog Devices', 'syslog'); ?>'>
			<div id='syslog_purge_dialog' style='display:none;'>
				<p><?php print __esc('Are you sure you want to purge stale Syslog devices?', 'syslog'); ?></p>
			</div>
			<script type='text/javascript'>
			$(function() {
				$('#syslog_purge_hosts').on('click', function() {
					$('#syslog_purge_dialog').dialog({
						title: <?php print syslog_json_safe(__('Confirm Purge', 'syslog')); ?>,
						minHeight: 80,
						minWidth: 400,
						resizable: false,
						draggable: true,
						buttons: {
							'Cancel': {
								text: <?php print syslog_json_safe(__('Cancel', 'syslog')); ?>,
								id: 'btnPurgeCancel',
								click: function() {
									$(this).dialog('close');
								}
							},
							'Continue': {
								text: <?php print syslog_json_safe(__('Continue', 'syslog')); ?>,
								id: 'btnPurgeContinue',
								click: function() {
									$(this).dialog('close');

									/* set the URL */
									var strURL = 'utilities.php?header=false';

									/* ensure that the csrf magic is appended */
									var json = {action: 'purge_syslog_hosts'};
									json.__csrf_magic = csrfMagicToken;

									if (typeof postUrl == 'function') {
										postUrl({url: strURL}, json);
									} else {
										loadPageUsingPost(strURL, json);
									}
								}
							}
						}
					});
				});
			});
			</script>
		</td>
		<td>
			<?php print __('This menu pick provides a means to remove Devices that are no longer reporting into Cacti\'s syslog server.', 'syslog'); ?>
		</td>
	</tr>
	<?php
}