syd 3.54.1

//
// Syd: rock-solid application kernel
// src/log/syslog.rs: syslog(2) interface
//
// Copyright (c) 2023, 2024, 2025, 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

// syslog.rs
//
// A self-contained Rust module that implements a kernel-like syslog(2)
// interface on top of a ring buffer from `ringbuf`, with multi-producer
// and multi-consumer semantics, using exactly one `parking_lot::RwLock`
// to synchronize concurrent producers (writers) and consumers
// (readers).
//
// SECURITY & CONCURRENCY DISCLAIMER:
//   - The ring buffer is shared among multiple producer threads (which
//   take a write lock) and multiple consumer threads (which typically
//   take a read lock). Certain consumer operations that modify the ring
//   (like CLEAR, READ_CLEAR) require upgradable or exclusive write
//   locks. We minimize lock hold times.
//   - Once locked (via `lock()`), the ring buffer is freed and any
//   subsequent ring-based operations return EPERM. Writes to the main
//   fd continue. Writes to the console fd do NOT continue after locked.
//
// If the "log" feature is not enabled, we provide stubs that return ENOSYS.

use btoi::btoi;
use memchr::arch::all::is_equal;

/// Kernel log levels (KERN_*).
#[derive(Copy, Clone, Debug, Eq, PartialEq, Ord, PartialOrd, Hash)]
pub enum LogLevel {
    /// KERN_EMERG
    Emergent = 0,
    /// KERN_ALERT
    Alert = 1,
    /// KERN_CRIT
    Crit = 2,
    /// KERN_ERR
    Err = 3,
    /// KERN_WARNING
    Warn = 4,
    /// KERN_NOTICE
    Notice = 5,
    /// KERN_INFO
    Info = 6,
    /// KERN_DEBUG
    Debug = 7,
}

impl LogLevel {
    /// Converts `LogLevel` to a number.
    pub fn as_u8(self) -> u8 {
        self as u8
    }

    /// Converts `LogLevel` to a bytestring.
    pub fn as_bytes(self) -> &'static [u8] {
        match self {
            Self::Emergent => b"emerg",
            Self::Alert => b"alert",
            Self::Crit => b"crit",
            Self::Err => b"error",
            Self::Warn => b"warn",
            Self::Notice => b"notice",
            Self::Info => b"info",
            Self::Debug => b"debug",
        }
    }
}

impl From<u8> for LogLevel {
    fn from(level: u8) -> Self {
        let level = level.clamp(Self::Emergent.as_u8(), Self::Debug.as_u8());

        if level == Self::Emergent.as_u8() {
            Self::Emergent
        } else if level == Self::Alert.as_u8() {
            Self::Alert
        } else if level == Self::Crit.as_u8() {
            Self::Crit
        } else if level == Self::Err.as_u8() {
            Self::Err
        } else if level == Self::Warn.as_u8() {
            Self::Warn
        } else if level == Self::Notice.as_u8() {
            Self::Notice
        } else if level == Self::Info.as_u8() {
            Self::Info
        } else {
            Self::Debug
        }
    }
}

impl From<i64> for LogLevel {
    #[expect(clippy::cast_possible_truncation)]
    #[expect(clippy::cast_sign_loss)]
    fn from(level: i64) -> Self {
        (level.clamp(Self::Emergent.as_u8().into(), Self::Debug.as_u8().into()) as u8).into()
    }
}

/// Translate a string log level from environment to `LogLevel`
/// or fallback to the given default `LogLevel`.
pub fn parse_loglevel(level: &[u8], default: LogLevel) -> LogLevel {
    let level = level.trim_ascii();
    if level.is_empty() {
        default
    } else if let Ok(level) = btoi::<i64>(level) {
        level.into()
    } else if is_equal(level, b"emerg") {
        LogLevel::Emergent
    } else if is_equal(level, b"alert") {
        LogLevel::Alert
    } else if is_equal(level, b"crit") {
        LogLevel::Crit
    } else if is_equal(level, b"error") {
        LogLevel::Err
    } else if is_equal(level, b"warn") {
        LogLevel::Warn
    } else if is_equal(level, b"notice") {
        LogLevel::Notice
    } else if is_equal(level, b"info") {
        LogLevel::Info
    } else if is_equal(level, b"debug") {
        LogLevel::Debug
    } else {
        default
    }
}

//
// Syslog action constants
//

/// Close the log.  Currently a NOP.
pub const SYSLOG_ACTION_CLOSE: libc::c_int = 0;

/// Open the log.  Currently a NOP.
pub const SYSLOG_ACTION_OPEN: libc::c_int = 1;

/// Read from the log. The call waits until the kernel log buffer
/// is nonempty, and then reads at most len bytes into the buffer
/// pointed to by bufp. The call returns the number of bytes read.
/// Bytes read from the log disappear from the log buffer: the
/// information can be read only once. This is the function
/// executed by the kernel when a user program reads /proc/kmsg.
pub const SYSLOG_ACTION_READ: libc::c_int = 2;

/// Read all messages remaining in the ring buffer, placing them in
/// the buffer pointed to by bufp.  The call reads the last len
/// bytes from the log buffer (nondestructively), but will not read
/// more than was written into the buffer since the last "clear ring
/// buffer" command (see command 5 below)).  The call returns the
/// number of bytes read.
pub const SYSLOG_ACTION_READ_ALL: libc::c_int = 3;

/// Read and clear all messages remaining in the ring buffer.
/// The call does precisely the same as for a type of 3, but
/// also executes the "clear ring buffer" command.
pub const SYSLOG_ACTION_READ_CLEAR: libc::c_int = 4;

/// The call executes just the "clear ring buffer" command.
/// The bufp and len arguments are ignored.
///
/// This command does not really clear the ring buffer.
/// Rather, it sets a kernel bookkeeping variable that
/// determines the results returned by commands 3
/// (SYSLOG_ACTION_READ_ALL) and 4 (SYSLOG_ACTION_READ_CLEAR).
/// This command has no effect on commands 2
/// (SYSLOG_ACTION_READ) and 9 (SYSLOG_ACTION_SIZE_UNREAD).
pub const SYSLOG_ACTION_CLEAR: libc::c_int = 5;

/// The command saves the current value of console_loglevel
/// and then sets console_loglevel to
/// minimum_console_loglevel, so that no messages are printed
/// to the console.  Before Linux 2.6.32, the command simply
/// sets console_loglevel to minimum_console_loglevel.  See
/// the discussion of /proc/sys/kernel/printk, below.
///
/// The bufp and len arguments are ignored.
pub const SYSLOG_ACTION_CONSOLE_OFF: libc::c_int = 6;

/// If a previous SYSLOG_ACTION_CONSOLE_OFF command has been
/// performed, this command restores console_loglevel to the
/// value that was saved by that command.  Before Linux
/// 2.6.32, this command simply sets console_loglevel to
/// default_console_loglevel.  See the discussion of
/// /proc/sys/kernel/printk, below.
///
/// The bufp and len arguments are ignored.
pub const SYSLOG_ACTION_CONSOLE_ON: libc::c_int = 7;

/// The call sets console_loglevel to the value given in len,
/// which must be an integer between 1 and 8 (inclusive).  The
/// kernel silently enforces a minimum value of
/// minimum_console_loglevel for len.  See the log level
/// section for details.  The bufp argument is ignored.
pub const SYSLOG_ACTION_CONSOLE_LEVEL: libc::c_int = 8;

/// The call returns the number of bytes currently available
/// to be read from the kernel log buffer via command 2
/// (SYSLOG_ACTION_READ).  The bufp and len arguments are
/// ignored.
pub const SYSLOG_ACTION_SIZE_UNREAD: libc::c_int = 9;

/// This command returns the total size of the kernel log
/// buffer.  The bufp and len arguments are ignored.
pub const SYSLOG_ACTION_SIZE_BUFFER: libc::c_int = 10;

// LOG-ENABLED IMPLEMENTATION
#[cfg(feature = "log")]
mod syslog_enabled {
    use std::{
        io::Write,
        mem::MaybeUninit,
        os::fd::BorrowedFd,
        sync::{
            atomic::{AtomicBool, AtomicU8, Ordering},
            OnceLock,
        },
    };

    use nix::{
        errno::Errno,
        time::{clock_gettime, ClockId},
    };
    use ringbuf::{
        storage::{Array, Heap},
        traits::*,
        Arc, SharedRb,
    };

    use crate::{
        config::SYSLOG_STACK_SIZE,
        log::{emit_json_to_fd, global_log_rlimit, LogMap, LogValue, WriteBuf},
        syslog::*,
    };

    // Store ring buffer in an enum to handle "heap" vs "static" capacity.
    enum SyslogRb {
        Heap(Arc<SharedRb<Heap<u8>>>),
        Static(Arc<SharedRb<Array<u8, SYSLOG_STACK_SIZE>>>),
    }

    macro_rules! with_syslog_ring {
        ($self:expr, | $r:ident | $body:expr) => {
            match $self {
                SyslogRb::Heap(ref ring) => {
                    let $r = ring.as_ref();
                    $body
                }
                SyslogRb::Static(ref ring) => {
                    let $r = ring.as_ref();
                    $body
                }
            }
        };
    }

    /// Lockless multi-producer, multi-consumer ring buffer.
    pub struct Syslog {
        ring: SyslogRb,
        locked: AtomicBool,
        level: AtomicU8,
    }

    // SAFETY: All fields are sync.
    unsafe impl Sync for Syslog {}

    impl Syslog {
        /// Create syslog with given capacity and log level.
        pub fn new(cap: usize, level: LogLevel, use_stack: bool) -> Self {
            let ring = if use_stack {
                SyslogRb::Static(Arc::new(SharedRb::<Array<u8, SYSLOG_STACK_SIZE>>::default()))
            } else {
                SyslogRb::Heap(Arc::new(SharedRb::<Heap<u8>>::new(cap)))
            };

            Syslog {
                ring,
                locked: AtomicBool::new(false),
                level: AtomicU8::new(level as u8),
            }
        }

        /// Write a log message at `level`.
        pub fn write_log(&self, level: LogLevel, msg: &LogMap, tty: bool, msg_hash: u64) {
            if level.as_u8() > self.loglevel() {
                return;
            }

            let rlimit = global_log_rlimit();
            let (allowed, suppressed) = rlimit.should_log(msg_hash);
            if suppressed > 0 {
                self.emit_suppressed_summary(level, suppressed, tty);
            }
            if !allowed {
                return;
            }

            if let Some(fd) = Self::logfd() {
                emit_json_to_fd(fd, msg, tty, level);
            }

            if self.is_locked() {
                return;
            }

            self.emit_to_ring(level, msg);
        }

        fn emit_suppressed_summary(&self, level: LogLevel, count: u32, tty: bool) {
            let mut msg = LogMap::new();
            let _ = msg.try_insert("ctx", LogValue::Borrowed("log"));
            let _ = msg.try_insert("op", LogValue::Borrowed("rlimit"));
            let _ = msg.try_insert("suppressed", LogValue::from(count));

            if let Some(fd) = Self::logfd() {
                emit_json_to_fd(fd, &msg, tty, level);
            }

            if !self.is_locked() {
                self.emit_to_ring(level, &msg);
            }
        }

        /// Serialize a LogMap to compact JSON and push into ring buffer.
        fn emit_to_ring(&self, level: LogLevel, msg: &LogMap) {
            let mut ring_buf = WriteBuf::new();
            if msg.write_json(&mut ring_buf).is_ok() {
                // SAFETY: write_json always produces valid UTF-8.
                let msg_str = unsafe { std::str::from_utf8_unchecked(&ring_buf.0) };
                if let Ok(ring_msg) = self.try_format_ring_msg(level, msg_str) {
                    let _ = self.push_slice_overwrite(ring_msg.as_bytes());
                }
            }
        }

        /// syslog(2) interface. This is the main entry point.
        ///
        /// Returns EPERM if locked.
        #[expect(clippy::type_complexity)]
        pub fn syslog(
            &self,
            action: libc::c_int,
            len: usize,
        ) -> Result<(usize, Option<Vec<u8>>), Errno> {
            if self.is_locked() {
                return Err(Errno::EPERM);
            }

            match action {
                SYSLOG_ACTION_CLOSE | SYSLOG_ACTION_OPEN => Ok((0, None)),

                SYSLOG_ACTION_READ => {
                    if len == 0 {
                        return Ok((0, None));
                    }
                    self.read_and_consume(len)
                }

                SYSLOG_ACTION_READ_ALL => {
                    if len == 0 {
                        return Ok((0, None));
                    }
                    self.read_all_no_consume(len)
                }

                SYSLOG_ACTION_READ_CLEAR => {
                    if len == 0 {
                        return Ok((0, None));
                    }
                    let (count, data_vec) = self.read_all_no_consume(len)?;
                    if count > 0 {
                        self.pop_count(count);
                    }
                    Ok((count, data_vec))
                }

                SYSLOG_ACTION_CLEAR => {
                    self.skip_all();
                    Ok((0, None))
                }

                SYSLOG_ACTION_CONSOLE_OFF => {
                    self.set_loglevel(LogLevel::Emergent.as_u8());
                    Ok((0, None))
                }

                SYSLOG_ACTION_CONSOLE_ON => {
                    self.set_loglevel(LogLevel::Warn.as_u8());
                    Ok((0, None))
                }

                SYSLOG_ACTION_CONSOLE_LEVEL => {
                    // Linux rejects if level isn't in range 1..=8.
                    let level: u8 = len.try_into().or(Err(Errno::EINVAL))?;
                    if !(1..=8).contains(&level) {
                        return Err(Errno::EINVAL);
                    }
                    self.set_loglevel(level);
                    Ok((0, None))
                }

                SYSLOG_ACTION_SIZE_UNREAD => {
                    let unread = self.ring_unread();
                    Ok((unread, None))
                }

                SYSLOG_ACTION_SIZE_BUFFER => {
                    let cap = self.ring_capacity();
                    Ok((cap, None))
                }

                _ => Err(Errno::EINVAL),
            }
        }

        /// Return `Some(BorrowedFd)` if logging is enabled, `None` otherwise.
        pub fn logfd() -> Option<BorrowedFd<'static>> {
            crate::log::log_fd()
        }

        /// Returns current console log level (0..7).
        pub fn loglevel(&self) -> u8 {
            self.level.load(Ordering::SeqCst)
        }

        /// Sets console log level, clamped to [0..7].
        pub fn set_loglevel(&self, level: u8) {
            let lv = level.clamp(LogLevel::Emergent.as_u8(), LogLevel::Debug.as_u8());
            self.level.store(lv, Ordering::SeqCst);
        }

        /// Returns true if syslog is locked.
        pub fn is_locked(&self) -> bool {
            self.locked.load(Ordering::SeqCst)
        }

        /// Lock syslog and drain ring. Returns true if newly locked.
        pub fn lock(&self) -> bool {
            if self
                .locked
                .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
                .is_ok()
            {
                self.skip_all();
                true
            } else {
                false
            }
        }

        // Format: "<LEVEL>[   12.345678] msg\n"
        fn try_format_ring_msg(&self, level: LogLevel, msg: &str) -> Result<String, Errno> {
            #[expect(clippy::cast_precision_loss)]
            let now = match clock_gettime(ClockId::CLOCK_BOOTTIME) {
                Ok(ts) => ts.tv_sec() as f64 + (ts.tv_nsec() as f64 / 1_000_000_000.0),
                Err(_) => 0.0,
            };

            let mut buf = WriteBuf::new();
            writeln!(buf, "<{}>[{:12.6}] {}", level.as_u8(), now, msg).or(Err(Errno::ENOMEM))?;

            // SAFETY: write! with valid UTF-8 inputs produces valid UTF-8.
            Ok(unsafe { String::from_utf8_unchecked(buf.into_inner()) })
        }

        // Read and consume ring data.
        #[expect(clippy::type_complexity)]
        fn read_and_consume(&self, len: usize) -> Result<(usize, Option<Vec<u8>>), Errno> {
            let (count, out) = self.peek_and_copy(len)?;

            if count == 0 {
                return Ok((0, None));
            }

            self.pop_count(count);

            Ok((count, Some(out)))
        }

        // Read-all without consumption.
        #[expect(clippy::type_complexity)]
        fn read_all_no_consume(&self, len: usize) -> Result<(usize, Option<Vec<u8>>), Errno> {
            let (count, out) = self.peek_and_copy(len)?;

            if count == 0 {
                Ok((0, None))
            } else {
                Ok((count, Some(out)))
            }
        }

        // Skip all ring content.
        fn skip_all(&self) {
            with_syslog_ring!(&self.ring, |ring| {
                let n = ring.occupied_len();

                if n > 0 {
                    // SAFETY: u8 is Copy so just advance read index.
                    unsafe { ring.advance_read_index(n) };
                }
            });
        }

        // Pop 'count' items from ring.
        fn pop_count(&self, count: usize) {
            if count == 0 {
                return;
            }

            with_syslog_ring!(&self.ring, |ring| {
                let n = count.min(ring.occupied_len());

                if n > 0 {
                    // SAFETY: u8 is Copy so just advance read index.
                    unsafe { ring.advance_read_index(n) };
                }
            });
        }

        // Peek up to `len` bytes without consuming.
        fn peek_and_copy(&self, len: usize) -> Result<(usize, Vec<u8>), Errno> {
            with_syslog_ring!(&self.ring, |ring| {
                let rlen = ring.occupied_len().min(len);
                if rlen == 0 {
                    return Ok((0, Vec::new()));
                }

                let (left, right) = ring.occupied_slices();

                let mut out = Vec::new();
                out.try_reserve(rlen).or(Err(Errno::ENOMEM))?;

                let left_n = rlen.min(left.len());
                for item in left.iter().take(left_n) {
                    // SAFETY: Occupied region is initialized.
                    out.push(unsafe { item.assume_init() });
                }

                let right_n = rlen.checked_sub(left_n).ok_or(Errno::EOVERFLOW)?;
                for item in right.iter().take(right_n) {
                    // SAFETY: Occupied region is initialized.
                    out.push(unsafe { item.assume_init() });
                }

                Ok((out.len(), out))
            })
        }

        // Push with overwrite. Evict oldest data if full.
        fn push_slice_overwrite(&self, data: &[u8]) -> Result<(), Errno> {
            with_syslog_ring!(&self.ring, |ring| {
                let cap = ring.capacity().get();
                let occ = ring.occupied_len();

                // Evict to make room.
                let vacant = cap.checked_sub(occ).ok_or(Errno::EOVERFLOW)?;

                let evict = if data.len() > vacant {
                    data.len().checked_sub(vacant).ok_or(Errno::EOVERFLOW)?
                } else {
                    0
                };

                if evict > 0 {
                    let n = evict.min(occ);

                    // SAFETY: u8 is Copy so just advance read index.
                    unsafe { ring.advance_read_index(n) };
                }

                // Clamp to capacity.
                let data = if data.len() > cap {
                    let off = data.len().checked_sub(cap).ok_or(Errno::EOVERFLOW)?;
                    &data[off..]
                } else {
                    data
                };

                let wi = ring.write_index();
                let ri = ring.read_index();
                let end = ri.checked_add(cap).ok_or(Errno::EOVERFLOW)?;

                // SAFETY: Vacant region between wi..end.
                let (left, right) = unsafe { ring.unsafe_slices_mut(wi, end) };

                let left_n = data.len().min(left.len());

                // SAFETY: u8 and MaybeUninit<u8> have identical layouts.
                left[..left_n].copy_from_slice(unsafe {
                    &*(std::ptr::from_ref::<[u8]>(&data[..left_n]) as *const [MaybeUninit<u8>])
                });

                let right_n = data.len().checked_sub(left_n).ok_or(Errno::EOVERFLOW)?;
                if right_n > 0 {
                    // SAFETY: u8 and MaybeUninit<u8> have identical layouts.
                    right[..right_n].copy_from_slice(unsafe {
                        &*(std::ptr::from_ref::<[u8]>(&data[left_n..])
                            as *const [MaybeUninit<u8>])
                    });
                }

                let written = left_n.checked_add(right_n).ok_or(Errno::EOVERFLOW)?;

                // SAFETY: Wrote "written" bytes into vacant region.
                unsafe { ring.advance_write_index(written) };

                Ok(())
            })
        }

        // Read current unread length (no pop).
        fn ring_unread(&self) -> usize {
            with_syslog_ring!(&self.ring, |ring| ring.occupied_len())
        }

        // Get ring capacity.
        fn ring_capacity(&self) -> usize {
            with_syslog_ring!(&self.ring, |ring| ring.capacity().get())
        }
    }

    /// Global syslog instance.
    pub static SYSLOG_INSTANCE: OnceLock<Syslog> = OnceLock::new();

    /// Initialize the global `Syslog` instance.
    pub fn init_global_syslog(cap: usize, level: LogLevel, use_stack: bool) -> Result<(), Errno> {
        if !use_stack && cap == 0 {
            return Err(Errno::EINVAL);
        }

        SYSLOG_INSTANCE
            .set(Syslog::new(cap, level, use_stack))
            .or(Err(Errno::EAGAIN))
    }

    /// Returns the global `Syslog` instance.
    pub fn global_syslog() -> Option<&'static Syslog> {
        SYSLOG_INSTANCE.get()
    }
} // end of syslog_enabled

// PUBLIC RE-EXPORTS
#[cfg(feature = "log")]
pub use syslog_enabled::*;

/// Returns current log level of the global `Syslog`.
#[cfg(feature = "log")]
#[inline(always)]
pub fn current_loglevel() -> u8 {
    global_syslog().map(|sys| sys.loglevel()).unwrap_or(4)
}

/// This still parses log level from SYD_LOG,
/// so dry run with SYD_LOG=debug works,
/// even if the log feature is disabled.
#[cfg(not(feature = "log"))]
#[inline(always)]
pub fn current_loglevel() -> u8 {
    use std::{os::unix::ffi::OsStrExt, sync::LazyLock};

    static LOGLEVEL: LazyLock<u8> = LazyLock::new(|| {
        std::env::var_os(crate::config::ENV_LOG)
            .map(|val| parse_loglevel(val.as_os_str().as_bytes(), LogLevel::Warn))
            .unwrap_or(LogLevel::Warn)
            .as_u8()
    });

    *LOGLEVEL
}

/// Returns whether given log level is enabled.
#[macro_export]
macro_rules! log_enabled {
    ($level:expr) => {
        $crate::syslog::current_loglevel() >= $level.as_u8()
    };
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_log_level_1() {
        assert_eq!(LogLevel::Emergent.as_u8(), 0);
        assert_eq!(LogLevel::Alert.as_u8(), 1);
        assert_eq!(LogLevel::Crit.as_u8(), 2);
        assert_eq!(LogLevel::Err.as_u8(), 3);
        assert_eq!(LogLevel::Warn.as_u8(), 4);
        assert_eq!(LogLevel::Notice.as_u8(), 5);
        assert_eq!(LogLevel::Info.as_u8(), 6);
        assert_eq!(LogLevel::Debug.as_u8(), 7);
    }

    #[test]
    fn test_log_level_2() {
        assert_eq!(LogLevel::Emergent.as_bytes(), b"emerg");
        assert_eq!(LogLevel::Alert.as_bytes(), b"alert");
        assert_eq!(LogLevel::Crit.as_bytes(), b"crit");
        assert_eq!(LogLevel::Err.as_bytes(), b"error");
        assert_eq!(LogLevel::Warn.as_bytes(), b"warn");
        assert_eq!(LogLevel::Notice.as_bytes(), b"notice");
        assert_eq!(LogLevel::Info.as_bytes(), b"info");
        assert_eq!(LogLevel::Debug.as_bytes(), b"debug");
    }

    #[test]
    fn test_log_level_3() {
        assert_eq!(LogLevel::from(0u8), LogLevel::Emergent);
        assert_eq!(LogLevel::from(1u8), LogLevel::Alert);
        assert_eq!(LogLevel::from(2u8), LogLevel::Crit);
        assert_eq!(LogLevel::from(3u8), LogLevel::Err);
        assert_eq!(LogLevel::from(4u8), LogLevel::Warn);
        assert_eq!(LogLevel::from(5u8), LogLevel::Notice);
        assert_eq!(LogLevel::from(6u8), LogLevel::Info);
        assert_eq!(LogLevel::from(7u8), LogLevel::Debug);
    }

    #[test]
    fn test_log_level_4() {
        assert_eq!(LogLevel::from(8u8), LogLevel::Debug);
        assert_eq!(LogLevel::from(255u8), LogLevel::Debug);
    }

    #[test]
    fn test_log_level_5() {
        assert_eq!(LogLevel::from(0i64), LogLevel::Emergent);
        assert_eq!(LogLevel::from(3i64), LogLevel::Err);
        assert_eq!(LogLevel::from(7i64), LogLevel::Debug);
    }

    #[test]
    fn test_log_level_6() {
        assert_eq!(LogLevel::from(-1i64), LogLevel::Emergent);
        assert_eq!(LogLevel::from(-100i64), LogLevel::Emergent);
    }

    #[test]
    fn test_log_level_7() {
        assert_eq!(LogLevel::from(100i64), LogLevel::Debug);
    }

    #[test]
    fn test_log_level_8() {
        assert!(LogLevel::Emergent < LogLevel::Alert);
        assert!(LogLevel::Alert < LogLevel::Crit);
        assert!(LogLevel::Crit < LogLevel::Err);
        assert!(LogLevel::Err < LogLevel::Warn);
        assert!(LogLevel::Warn < LogLevel::Notice);
        assert!(LogLevel::Notice < LogLevel::Info);
        assert!(LogLevel::Info < LogLevel::Debug);
    }

    #[test]
    fn test_log_level_9() {
        let level = LogLevel::Info;
        let cloned = level;
        assert_eq!(level, cloned);
    }

    #[test]
    fn test_parse_loglevel_1() {
        assert_eq!(parse_loglevel(b"0", LogLevel::Warn), LogLevel::Emergent);
        assert_eq!(parse_loglevel(b"3", LogLevel::Warn), LogLevel::Err);
        assert_eq!(parse_loglevel(b"7", LogLevel::Warn), LogLevel::Debug);
    }

    #[test]
    fn test_parse_loglevel_2() {
        assert_eq!(parse_loglevel(b"emerg", LogLevel::Warn), LogLevel::Emergent);
        assert_eq!(parse_loglevel(b"alert", LogLevel::Warn), LogLevel::Alert);
        assert_eq!(parse_loglevel(b"crit", LogLevel::Warn), LogLevel::Crit);
        assert_eq!(parse_loglevel(b"error", LogLevel::Warn), LogLevel::Err);
        assert_eq!(parse_loglevel(b"warn", LogLevel::Warn), LogLevel::Warn);
        assert_eq!(parse_loglevel(b"notice", LogLevel::Warn), LogLevel::Notice);
        assert_eq!(parse_loglevel(b"info", LogLevel::Warn), LogLevel::Info);
        assert_eq!(parse_loglevel(b"debug", LogLevel::Warn), LogLevel::Debug);
    }

    #[test]
    fn test_parse_loglevel_3() {
        assert_eq!(parse_loglevel(b"", LogLevel::Info), LogLevel::Info);
    }

    #[test]
    fn test_parse_loglevel_4() {
        assert_eq!(parse_loglevel(b"  ", LogLevel::Info), LogLevel::Info);
    }

    #[test]
    fn test_parse_loglevel_5() {
        assert_eq!(parse_loglevel(b" debug ", LogLevel::Warn), LogLevel::Debug);
    }

    #[test]
    fn test_parse_loglevel_6() {
        assert_eq!(parse_loglevel(b"unknown", LogLevel::Info), LogLevel::Info);
    }

    #[test]
    fn test_parse_loglevel_7() {
        assert_eq!(parse_loglevel(b"-1", LogLevel::Warn), LogLevel::Emergent);
    }

    #[test]
    fn test_parse_loglevel_8() {
        assert_eq!(parse_loglevel(b"100", LogLevel::Warn), LogLevel::Debug);
    }

    #[test]
    fn test_syslog_1() {
        assert_eq!(SYSLOG_ACTION_CLOSE, 0);
        assert_eq!(SYSLOG_ACTION_OPEN, 1);
        assert_eq!(SYSLOG_ACTION_READ, 2);
        assert_eq!(SYSLOG_ACTION_READ_ALL, 3);
        assert_eq!(SYSLOG_ACTION_READ_CLEAR, 4);
        assert_eq!(SYSLOG_ACTION_CLEAR, 5);
        assert_eq!(SYSLOG_ACTION_CONSOLE_OFF, 6);
        assert_eq!(SYSLOG_ACTION_CONSOLE_ON, 7);
        assert_eq!(SYSLOG_ACTION_CONSOLE_LEVEL, 8);
        assert_eq!(SYSLOG_ACTION_SIZE_UNREAD, 9);
        assert_eq!(SYSLOG_ACTION_SIZE_BUFFER, 10);
    }

    #[cfg(feature = "log")]
    mod syslog_tests {
        use nix::errno::Errno;

        use super::*;
        use crate::{
            config::DEFAULT_LOG_RLIMIT_BURST,
            log::{LogMap, LogValue},
        };

        #[test]
        fn test_syslog_1() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            assert!(!syslog.is_locked());
            assert_eq!(syslog.loglevel(), LogLevel::Info.as_u8());
        }

        #[test]
        fn test_syslog_2() {
            let syslog = Syslog::new(0, LogLevel::Warn, true);
            assert!(!syslog.is_locked());
            assert_eq!(syslog.loglevel(), LogLevel::Warn.as_u8());
        }

        #[test]
        fn test_syslog_3() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            syslog.set_loglevel(0);
            assert_eq!(syslog.loglevel(), 0);
            syslog.set_loglevel(7);
            assert_eq!(syslog.loglevel(), 7);
            syslog.set_loglevel(255);
            assert_eq!(syslog.loglevel(), 7);
        }

        #[test]
        fn test_syslog_4() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            assert!(!syslog.is_locked());
            assert!(syslog.lock());
            assert!(syslog.is_locked());
            assert!(!syslog.lock());
        }

        #[test]
        fn test_syslog_5() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            syslog.lock();
            let result = syslog.syslog(SYSLOG_ACTION_READ_ALL, 100);
            assert_eq!(result, Err(Errno::EPERM));
        }

        #[test]
        fn test_syslog_6() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            assert_eq!(syslog.syslog(SYSLOG_ACTION_CLOSE, 0), Ok((0, None)));
            assert_eq!(syslog.syslog(SYSLOG_ACTION_OPEN, 0), Ok((0, None)));
        }

        #[test]
        fn test_syslog_7() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            assert_eq!(syslog.syslog(99, 100), Err(Errno::EINVAL));
        }

        #[test]
        fn test_syslog_8() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            assert_eq!(syslog.syslog(SYSLOG_ACTION_READ, 0), Ok((0, None)));
            assert_eq!(syslog.syslog(SYSLOG_ACTION_READ_ALL, 0), Ok((0, None)));
            assert_eq!(syslog.syslog(SYSLOG_ACTION_READ_CLEAR, 0), Ok((0, None)));
        }

        #[test]
        fn test_syslog_9() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            syslog.syslog(SYSLOG_ACTION_CONSOLE_OFF, 0).unwrap();
            assert_eq!(syslog.loglevel(), LogLevel::Emergent.as_u8());

            syslog.syslog(SYSLOG_ACTION_CONSOLE_ON, 0).unwrap();
            assert_eq!(syslog.loglevel(), LogLevel::Warn.as_u8());
        }

        #[test]
        fn test_syslog_10() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            syslog.syslog(SYSLOG_ACTION_CONSOLE_LEVEL, 5).unwrap();
            assert_eq!(syslog.loglevel(), 5);
        }

        #[test]
        fn test_syslog_11() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            let (cap, _) = syslog.syslog(SYSLOG_ACTION_SIZE_BUFFER, 0).unwrap();
            assert!(cap > 0);
        }

        #[test]
        fn test_syslog_12() {
            let syslog = Syslog::new(1024, LogLevel::Info, false);
            let (unread, _) = syslog.syslog(SYSLOG_ACTION_SIZE_UNREAD, 0).unwrap();
            assert_eq!(unread, 0);
        }

        #[test]
        fn test_syslog_13() {
            let syslog = Syslog::new(4096, LogLevel::Debug, false);
            let mut map = LogMap::new();
            let _ = map.try_insert("msg", LogValue::Borrowed("test message"));
            syslog.write_log(LogLevel::Info, &map, false, 0);

            let (unread, _) = syslog.syslog(SYSLOG_ACTION_SIZE_UNREAD, 0).unwrap();
            assert!(unread > 0);

            let (count, data) = syslog.syslog(SYSLOG_ACTION_READ_ALL, 4096).unwrap();
            assert!(count > 0);
            let data = data.unwrap();
            let text = String::from_utf8_lossy(&data);
            assert!(text.contains("test message"));
        }

        #[test]
        fn test_syslog_14() {
            let syslog = Syslog::new(4096, LogLevel::Err, false);
            let mut map = LogMap::new();
            let _ = map.try_insert("msg", LogValue::Borrowed("filtered message"));
            syslog.write_log(LogLevel::Info, &map, false, 0);

            let (unread, _) = syslog.syslog(SYSLOG_ACTION_SIZE_UNREAD, 0).unwrap();
            assert_eq!(unread, 0);
        }

        #[test]
        fn test_syslog_15() {
            let syslog = Syslog::new(4096, LogLevel::Debug, false);
            let mut map = LogMap::new();
            let _ = map.try_insert("msg", LogValue::Borrowed("clear test"));
            syslog.write_log(LogLevel::Info, &map, false, 0);
            syslog.syslog(SYSLOG_ACTION_CLEAR, 0).unwrap();

            let (count, _) = syslog.syslog(SYSLOG_ACTION_READ_ALL, 4096).unwrap();
            assert_eq!(count, 0);
        }

        #[test]
        fn test_syslog_16() {
            let syslog = Syslog::new(4096, LogLevel::Debug, false);
            let mut map = LogMap::new();
            let _ = map.try_insert("msg", LogValue::Borrowed("read_clear test"));
            syslog.write_log(LogLevel::Info, &map, false, 0);

            let (count, data) = syslog.syslog(SYSLOG_ACTION_READ_CLEAR, 4096).unwrap();
            assert!(count > 0);
            assert!(data.is_some());

            let (unread, _) = syslog.syslog(SYSLOG_ACTION_SIZE_UNREAD, 0).unwrap();
            assert_eq!(unread, 0);
        }

        fn compute_msg_hash(map: &crate::log::LogMap) -> u64 {
            use std::hash::{Hash, Hasher};
            let mut hasher = std::hash::DefaultHasher::new();
            map.hash(&mut hasher);
            hasher.finish()
        }

        #[test]
        fn test_syslog_17() {
            let mut a = LogMap::new();
            let _ = a.try_insert("ctx", LogValue::Borrowed("test"));
            let _ = a.try_insert("msg", LogValue::Borrowed("denied"));

            let mut b = LogMap::new();
            let _ = b.try_insert("ctx", LogValue::Borrowed("test"));
            let _ = b.try_insert("msg", LogValue::Borrowed("denied"));

            assert_eq!(compute_msg_hash(&a), compute_msg_hash(&b));
        }

        #[test]
        fn test_syslog_18() {
            let mut a = LogMap::new();
            let _ = a.try_insert("ctx", LogValue::Borrowed("test"));
            let _ = a.try_insert("msg", LogValue::Borrowed("denied"));

            let mut b = LogMap::new();
            let _ = b.try_insert("ctx", LogValue::Borrowed("test"));
            let _ = b.try_insert("msg", LogValue::Borrowed("allowed"));

            assert_ne!(compute_msg_hash(&a), compute_msg_hash(&b));
        }

        #[test]
        fn test_syslog_19() {
            let mut original = LogMap::new();
            let _ = original.try_insert("ctx", LogValue::Borrowed("test"));
            let hash_before = compute_msg_hash(&original);

            let mut enriched = LogMap::new();
            let _ = enriched.try_insert("ctx", LogValue::Borrowed("test"));
            let _ = enriched.try_insert("time", LogValue::Borrowed("2026-01-01"));
            let _ = enriched.try_insert("pid", LogValue::from(42i32));

            assert_eq!(hash_before, compute_msg_hash(&enriched));
            assert_eq!(hash_before, compute_msg_hash(&original));
        }

        #[test]
        fn test_syslog_20() {
            let syslog = Syslog::new(8192, LogLevel::Debug, false);

            let mut map = LogMap::new();
            let _ = map.try_insert("ctx", LogValue::Borrowed("spam"));
            let hash = compute_msg_hash(&map);

            for _ in 0..15 {
                syslog.write_log(LogLevel::Info, &map, false, hash);
            }

            let (count, data) = syslog.syslog(SYSLOG_ACTION_READ_ALL, 8192).unwrap();
            assert!(count > 0);
            let data = data.unwrap();
            let text = String::from_utf8_lossy(&data);
            let lines: Vec<&str> = text.lines().filter(|l| l.contains("spam")).collect();

            assert_eq!(lines.len(), DEFAULT_LOG_RLIMIT_BURST as usize);
        }

        #[test]
        fn test_syslog_21() {
            let syslog = Syslog::new(8192, LogLevel::Debug, false);

            let mut map_a = LogMap::new();
            let _ = map_a.try_insert("ctx", LogValue::Borrowed("aaa"));
            let hash_a = compute_msg_hash(&map_a);

            let mut map_b = LogMap::new();
            let _ = map_b.try_insert("ctx", LogValue::Borrowed("bbb"));
            let hash_b = compute_msg_hash(&map_b);

            assert_ne!(hash_a, hash_b);

            for _ in 0..5 {
                syslog.write_log(LogLevel::Info, &map_a, false, hash_a);
                syslog.write_log(LogLevel::Info, &map_b, false, hash_b);
            }

            let (_, data) = syslog.syslog(SYSLOG_ACTION_READ_ALL, 8192).unwrap();
            let data = data.unwrap();
            let text = String::from_utf8_lossy(&data);
            let a_count = text.lines().filter(|l| l.contains("aaa")).count();
            let b_count = text.lines().filter(|l| l.contains("bbb")).count();
            assert_eq!(a_count, 5);
            assert_eq!(b_count, 5);
        }
    }
}