syslog_removal.php

<?php
/*
 +-------------------------------------------------------------------------+
 | Copyright (C) 2004-2026 The Cacti Group                                 |
 |                                                                         |
 | This program is free software; you can redistribute it and/or           |
 | modify it under the terms of the GNU General Public License             |
 | as published by the Free Software Foundation; either version 2          |
 | of the License, or (at your option) any later version.                  |
 |                                                                         |
 | This program is distributed in the hope that it will be useful,         |
 | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
 | GNU General Public License for more details.                            |
 +-------------------------------------------------------------------------+
 | Cacti: The Complete RRDTool-based Graphing Solution                     |
 +-------------------------------------------------------------------------+
 | This code is designed, written, and maintained by the Cacti Group. See  |
 | about.php and/or the AUTHORS file for specific developer information.   |
 +-------------------------------------------------------------------------+
 | http://www.cacti.net/                                                   |
 +-------------------------------------------------------------------------+
*/

chdir('../../');
include('./include/auth.php');
include_once('./lib/xml.php');
include_once(__DIR__ . '/setup.php');

syslog_connect();

// redefine the syslog actions for removal rules
$syslog_actions = [
	1 => __('Delete', 'syslog'),
	2 => __('Disable', 'syslog'),
	3 => __('Enable', 'syslog'),
	4 => __('Reprocess', 'syslog'),
	5 => __('Export', 'syslog'),
];

// set default action
set_default_action();

// The "Test rule" action runs a read-only preview of the rule currently
// in the editor and returns JSON without touching any database data.
if (get_request_var('action') == 'test') {
	header('Content-Type: application/json; charset=UTF-8');
	print syslog_rule_test_action('removal');
	exit;
}

if (isset_request_var('import') && syslog_allow_rule_edits()) {
	set_request_var('action', 'import');
}

switch (get_request_var('action')) {
	case 'save':
		if (isset_request_var('save_component_import')) {
			removal_import();
		} else {
			form_save();
		}

		break;
	case 'actions':
		form_actions();

		break;
	case 'import':
		if (!syslog_allow_rule_edits()) {
			die(__('Permission denied.', 'syslog'));
		}

		top_header();
		syslog_include_js();
		import();
		bottom_footer();

		break;
	case 'export':
		removal_export();

		break;
	case 'edit':
	case 'newedit':
		top_header();
		syslog_include_js();

		syslog_action_edit();

		bottom_footer();

		break;
	default:
		top_header();
		syslog_include_js();

		syslog_removal();

		bottom_footer();

		break;
}

/* --------------------------
	The Save Function
   -------------------------- */

/**
 * Save a Syslog Removal Rule and redirect back to the edit screen.
 *
 * @return void
 */
function form_save(): void {
	if (!syslog_allow_rule_edits()) {
		die(__('Permission denied.', 'syslog'));
	}

	if ((isset_request_var('save_component_removal')) && (isempty_request_var('add_dq_y'))) {
		$removalid = api_syslog_removal_save(get_filter_request_var('id'), get_nfilter_request_var('name'),
			get_nfilter_request_var('type'), get_nfilter_request_var('message'),
			get_nfilter_request_var('rmethod'), get_nfilter_request_var('notes'), get_nfilter_request_var('enabled'));

		if ((is_error_message()) || (get_filter_request_var('id') != get_filter_request_var('_id'))) {
			header('Location: syslog_removal.php?header=false&action=edit&id=' . (empty($removalid) ? get_request_var('id') : $removalid));
		} else {
			header('Location: syslog_removal.php?header=false');
		}
	}
}

/* ------------------------
	The 'actions' function
   ------------------------ */

/**
 * Display the bulk action confirmation form for the selected Syslog Removal Rules.
 *
 * @return void
 */
function form_actions(): void {
	global $config, $syslog_actions, $fields_syslog_action_edit;
	global $syslogdb_default;

	if (!syslog_allow_rule_edits()) {
		die(__('Permission denied.', 'syslog'));
	}

	get_filter_request_var('drp_action', FILTER_VALIDATE_REGEXP,
		['options' => ['regexp' => '/^([a-zA-Z0-9_]+)$/']]);

	// if we are to save this form, instead of display it
	if (isset_request_var('selected_items')) {
		$selected_items = sanitize_unserialize_selected_items(get_nfilter_request_var('selected_items'));
		$drp_action     = get_request_var('drp_action');

		$action_map = [
			'1' => 'api_syslog_removal_remove',
			'2' => 'api_syslog_removal_disable',
			'3' => 'api_syslog_removal_enable',
			'4' => 'api_syslog_removal_reprocess'
		];

		syslog_apply_selected_items_action(
			$selected_items,
			$drp_action,
			$action_map,
			'5',
			get_nfilter_request_var('selected_items')
		);

		header('Location: syslog_removal.php?header=false');

		exit;
	}

	top_header();

	form_start('syslog_removal.php');

	html_start_box($syslog_actions[get_request_var('drp_action')], '60%', false, 3, 'center', '');

	// setup some variables
	$removal_array = [];
	$removal_list  = '';
	$title         = '';

	// loop through each of the clusters selected on the previous page and get more info about them
	foreach ($_POST as $var => $val) {
		if (preg_match('/^chk_([0-9]+)$/', $var, $matches)) {
			// ================= input validation =================
			input_validate_input_number($matches[1]);
			// ====================================================

			$removal_info = syslog_db_fetch_cell_prepared("SELECT name
				FROM `$syslogdb_default`.`syslog_remove`
				WHERE id = ?",
				[$matches[1]]);

			$removal_list .= '<li>' . html_escape($removal_info) . '</li>';
			$removal_array[] = $matches[1];
		}
	}

	if (cacti_sizeof($removal_array)) {
		if (get_request_var('drp_action') == '1') { // delete
			print "<tr>
				<td class='textArea'>
					<p>" . __('Click \'Continue\' to Delete the following Syslog Removal Rule(s).', 'syslog') . "</p>
					<div class='itemlist'><ul>$removal_list</ul></div>";
			print "</td></tr>
				</td>
			</tr>\n";

			$title = __esc('Delete Syslog Removal Rule(s)', 'syslog');
		} elseif (get_request_var('drp_action') == '2') { // disable
			print "<tr>
				<td class='textArea'>
					<p>" . __('Click \'Continue\' to Disable the following Syslog Removal Rule(s).', 'syslog') . "</p>
					<div class='itemlist'><ul>$removal_list</ul></div>";
			print "</td></tr>
				</td>
			</tr>\n";

			$title = __esc('Disable Syslog Removal Rule(s)', 'syslog');
		} elseif (get_request_var('drp_action') == '3') { // enable
			print "<tr>
				<td class='textArea'>
					<p>" . __('Click \'Continue\' to Enable the following Syslog Removal Rule(s).', 'syslog') . "</p>
					<div class='itemlist'><ul>$removal_list</ul></div>";
			print "</td></tr>
				</td>
			</tr>\n";

			$title = __esc('Enable Syslog Removal Rule(s)', 'syslog');
		} elseif (get_request_var('drp_action') == '4') { // reprocess
			print "<tr>
				<td class='textArea'>
					<p>" . __('Click \'Continue\' to Re-process the following Syslog Removal Rule(s).', 'syslog') . "</p>
					<div class='itemlist'><ul>$removal_list</ul></div>";
			print "</td></tr>
				</td>
			</tr>\n";

			$title = __esc('Retroactively Process Syslog Removal Rule(s)', 'syslog');
		} elseif (get_request_var('drp_action') == '5') { // export
			print "<tr>
				<td class='textArea'>
					<p>" . __('Click \'Continue\' to Export the following Syslog Removal Rule(s).', 'syslog') . "</p>
					<div class='itemlist'><ul>$removal_list</ul></div>";
			print "</td></tr>
				</td>
			</tr>\n";

			$title = __esc('Export Syslog Removal Rule(s)', 'syslog');
		}

		$save_html = "<input type='button' value='" . __esc('Cancel', 'syslog') . "' class='cactiReturnTo'>&nbsp;<input type='submit' value='" . __esc('Continue', 'syslog') . "' title='$title'";
	} else {
		raise_message(40);
		header('Location: syslog_removal.php?header=false');
		exit;
	}

	print "<tr>
		<td class='saveRow'>
			<input type='hidden' name='action' value='actions'>
			<input type='hidden' name='selected_items' value='" . serialize($removal_array) . "'>
			<input type='hidden' name='drp_action' value='" . get_request_var('drp_action') . "'>
			$save_html
		</td>
	</tr>";

	html_end_box();

	form_end();

	bottom_footer();
}

/**
 * Export the selected Syslog Removal Rules as a JSON download.
 *
 * @return void
 */
function removal_export(): void {
	global $syslogdb_default;

	// if we are to save this form, instead of display it
	if (isset_request_var('selected_items')) {
		$selected_items = sanitize_unserialize_selected_items(get_nfilter_request_var('selected_items'));

		if ($selected_items != false) {
			$rules = [];

			foreach ($selected_items as $id) {
				if ($id > 0) {
					$data = syslog_db_fetch_row_prepared("SELECT *
						FROM `$syslogdb_default`.`syslog_remove`
						WHERE id = ?",
						[$id]);

					if (cacti_sizeof($data)) {
						$rules[] = $data;
					}
				}
			}

			$output = syslog_rules_array2json('syslog_remove', $rules);
			header('Content-type: application/json');
			header('Content-Disposition: attachment; filename=syslog_removal_export.json');
			print $output;
		}
	}
}

/**
 * Validate and save a Syslog Removal Rule.
 *
 * @param int|string $id      The id of the Removal Rule, '' for a new rule.
 * @param string     $name    The name of the Removal Rule.
 * @param string     $type    The match type of the Removal Rule.
 * @param string     $message The match string of the Removal Rule.
 * @param string     $rmethod The method of removal, 'del' or 'trans'.
 * @param string     $notes   The notes of the Removal Rule.
 * @param string     $enabled 'on' when the Removal Rule is enabled, otherwise ''.
 *
 * @return int|false The id of the saved Removal Rule, or false when the save failed.
 */
function api_syslog_removal_save(int|string $id, string $name, string $type, string $message, string $rmethod, string $notes, string $enabled): int|false {
	global $config;
	global $syslogdb_default;

	// get the username
	$username = get_username($_SESSION['sess_user_id']);

	if ($id) {
		$save['id'] = $id;
	} else {
		$save['id'] = '';
	}

	$save['hash']    = get_hash_syslog($save['id'], 'syslog_remove');
	$save['name']    = form_input_validate($name,    'name',    '', false, 3);
	$save['type']    = form_input_validate($type,    'type',    '', false, 3);
	$save['message'] = form_input_validate($message, 'message', '', false, 3);
	$save['method']  = form_input_validate($rmethod,  'rmethod',  '', false, 3);
	$save['notes']   = form_input_validate($notes,   'notes',   '', true, 3);
	$save['enabled'] = ($enabled == 'on' ? 'on' : '');
	$save['date']    = time();
	$save['user']    = $username;

	// Structured filter rules are validated against the same compiler used
	// during processing.  SQL expression rules keep their free-form behavior.
	if ($type === 'filter' && !is_error_message()) {
		$probe = ['message' => $message, 'max_seq' => 0];

		if (!cacti_sizeof(syslog_get_removal_rule_sql($probe, 'syslog_incoming'))) {
			raise_message('filter_error', __('The filter is invalid: %s', ($GLOBALS['syslog_rule_filter_error'] ?? 'unknown error'), 'syslog'), MESSAGE_LEVEL_ERROR);

			return false;
		}
	}

	$id = 0;

	if (!is_error_message()) {
		// syslog_sync_save() does not return the saved id, so look it up
		syslog_sync_save($save, 'syslog_remove', 'id');

		$id = (int) syslog_db_fetch_cell_prepared("SELECT id
			FROM `$syslogdb_default`.`syslog_remove`
			WHERE hash = ?",
			[$save['hash']]);
	}

	return $id;
}

/**
 * Delete a Syslog Removal Rule by id.
 *
 * @param int $id The id of the Removal Rule to delete.
 *
 * @return void
 */
function api_syslog_removal_remove(int $id): void {
	global $syslogdb_default;
	syslog_db_execute_prepared("DELETE FROM `$syslogdb_default`.`syslog_remove` WHERE id = ?", [$id]);
}

/**
 * Disable a Syslog Removal Rule by id.
 *
 * @param int $id The id of the Removal Rule to disable.
 *
 * @return void
 */
function api_syslog_removal_disable(int $id): void {
	global $syslogdb_default;
	syslog_db_execute_prepared("UPDATE `$syslogdb_default`.`syslog_remove` SET enabled = '' WHERE id = ?", [$id]);
}

/**
 * Enable a Syslog Removal Rule by id.
 *
 * @param int $id The id of the Removal Rule to enable.
 *
 * @return void
 */
function api_syslog_removal_enable(int $id): void {
	global $syslogdb_default;
	syslog_db_execute_prepared("UPDATE `$syslogdb_default`.`syslog_remove` SET enabled = 'on' WHERE id = ?", [$id]);
}

/**
 * Retroactively apply a Syslog Removal Rule to existing syslog messages.
 *
 * @param int $id The id of the Removal Rule to reprocess.
 *
 * @return void
 */
function api_syslog_removal_reprocess(int $id): void {
	// remove records retroactively
	$syslog_items   = syslog_remove_items('syslog', $id);
	$syslog_removed = $syslog_items['removed'];
	$syslog_xferred = $syslog_items['xferred'];

	$name = syslog_db_fetch_cell_prepared('SELECT name
		FROM syslog_remove
		WHERE id = ?',
		[$id]);

	raise_message('syslog_info' . $id, __('Rule \'%s\' resulted in %s/%s messages removed/transferred', $name, $syslog_removed, $syslog_xferred, 'syslog'), MESSAGE_LEVEL_INFO);
}

/* ---------------------
	Removal Functions
   --------------------- */

/**
 * Fetch the Syslog Removal Rules matching the current filter, appending the
 * generated where clause and parameters to the given references.
 *
 * @param string            $sql_where  The where clause, passed by reference.
 * @param array<int, mixed> $sql_params The prepared SQL parameters, passed by reference.
 * @param int               $rows       The number of rows to fetch.
 *
 * @return array<int, array<string, mixed>> The matching Removal Rules.
 */
function syslog_get_removal_records(&$sql_where, &$sql_params, int $rows): array {
	global $syslogdb_default;

	if (get_request_var('filter') != '') {
		$sql_where .= (strlen($sql_where) ? ' AND ' : 'WHERE ') . '(message LIKE ? OR notes LIKE ? OR name LIKE ?)';

		$sql_params[] = '%' . get_request_var('filter') . '%';
		$sql_params[] = '%' . get_request_var('filter') . '%';
		$sql_params[] = '%' . get_request_var('filter') . '%';
	}

	if (get_request_var('enabled') != '-1') {
		if (get_request_var('enabled') == '1') {
			$sql_where .= (strlen($sql_where) ? ' AND ' : 'WHERE ') . "enabled='on'";
		} else {
			$sql_where .= (strlen($sql_where) ? ' AND ' : 'WHERE ') . "enabled=''";
		}
	}

	$sql_order = get_order_string();
	$sql_limit = ' LIMIT ' . ($rows * (get_request_var('page') - 1)) . ',' . $rows;

	$query_string = "SELECT *
		FROM `$syslogdb_default`.`syslog_remove`
		$sql_where
		$sql_order
		$sql_limit";

	return syslog_db_fetch_assoc_prepared($query_string, $sql_params);
}

/**
 * Display the Syslog Removal Rule edit form.
 *
 * @return void
 */
function syslog_action_edit(): void {
	global $message_types;
	global $syslogdb_default;

	// ================= input validation =================
	get_filter_request_var('id');
	get_filter_request_var('type');
	get_filter_request_var('date', FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => '/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/']]);
	// ====================================================

	if (isset_request_var('id') && get_nfilter_request_var('action') == 'edit') {
		$removal = syslog_db_fetch_row_prepared("SELECT *
			FROM `$syslogdb_default`.`syslog_remove`
			WHERE id = ?",
			[get_request_var('id')]);

		if (cacti_sizeof($removal)) {
			$header_label = __esc('Removal Rule Edit [edit: %s]', $removal['name'], 'syslog');
		} else {
			$header_label = __('Removal Rule Edit [new]', 'syslog');

			$removal['name'] = __('New Removal Record', 'syslog');
		}
	} elseif (isset_request_var('id') && get_nfilter_request_var('action') == 'newedit') {
		$sql_params   = [];
		$sql_where    = 'WHERE seq = ?';
		$sql_params[] = get_request_var('id');

		if (isset_request_var('date')) {
			$sql_where .= ' AND logtime = ?';
			$sql_params[] = get_request_var('date');
		}

		$syslog_rec = syslog_db_fetch_row_prepared("SELECT *
			FROM `$syslogdb_default`.`syslog`
			$sql_where", $sql_params);

		$header_label = __('Removal Rule Edit [new]', 'syslog');

		if (cacti_sizeof($syslog_rec)) {
			$removal['message'] = $syslog_rec['message'];
		}

		$removal['name'] = __('New Removal Rule', 'syslog');
		$removal['type'] = 'filter';
	} else {
		$header_label = '[new]';

		$removal['name'] = __('New Removal Record', 'syslog');
		$removal['type'] = 'filter';
	}

	$filter_conditions = [];

	if (($removal['type'] ?? '') === 'filter') {
		$filter_document = json_decode($removal['message'] ?? '', true);

		if (is_array($filter_document) && ($filter_document['version'] ?? null) === 1 && is_array($filter_document['conditions'] ?? null)) {
			$filter_conditions = $filter_document['conditions'];
		} elseif (get_nfilter_request_var('action') === 'newedit' && !empty($removal['message'])) {
			$filter_conditions = [[
				'join'     => 'AND',
				'negative' => false,
				'field'    => 'message',
				'operator' => 'contains',
				'value'    => $removal['message']
			]];
		}
	}

	// Present older simple rules as their equivalent SQL expression. This
	// changes the editor only; storage changes on explicit Save.
	if (in_array($removal['type'] ?? '', ['messageb', 'messagec', 'messagee', 'host', 'program', 'facility'], true)) {
		$column = match ($removal['type']) {
			'host'     => 'host',
			'program'  => 'program',
			'facility' => 'facility_id',
			default    => 'message'
		};

		if ($removal['type'] === 'facility') {
			// Facility rules store a name; resolve it to the normalized id.
			$facility_id = syslog_db_fetch_cell_prepared("SELECT facility_id
				FROM `$syslogdb_default`.`syslog_facilities`
				WHERE facility = ?",
				[$removal['message']]);

			$removal['message'] = '`facility_id` = ' . db_qstr($facility_id);
		} elseif ($removal['type'] === 'messageb') {
			$removal['message'] = '`message` LIKE ' . db_qstr($removal['message'] . '%');
		} elseif ($removal['type'] === 'messagec') {
			$removal['message'] = '`message` LIKE ' . db_qstr('%' . $removal['message'] . '%');
		} elseif ($removal['type'] === 'messagee') {
			$removal['message'] = '`message` LIKE ' . db_qstr('%' . $removal['message']);
		} else {
			$removal['message'] = '`' . $column . '` = ' . db_qstr($removal['message']);
		}

		$removal['type'] = 'sql';
	}

	$removal_message_types = [
		'filter' => $message_types['filter'],
		'sql'    => $message_types['sql']
	];

	$fields_syslog_removal_edit = [
		'spacer0' => [
			'method'        => 'spacer',
			'friendly_name' => __('Removal Rule Details', 'syslog')
		],
		'name' => [
			'method'        => 'textbox',
			'friendly_name' => __('Removal Rule Name', 'syslog'),
			'description'   => __('Please describe this Removal Rule.', 'syslog'),
			'value'         => '|arg1:name|',
			'max_length'    => '250',
			'size'          => 80
		],
		'enabled' => [
			'method'        => 'drop_array',
			'friendly_name' => __('Enabled?', 'syslog'),
			'description'   => __('Is this Removal Rule Enabled?', 'syslog'),
			'value'         => '|arg1:enabled|',
			'array'         => ['on' => __('Enabled', 'syslog'), '' => __('Disabled', 'syslog')],
			'default'       => 'on'
		],
		'type' => [
			'method'        => 'drop_array',
			'friendly_name' => __('String Match Type', 'syslog'),
			'description'   => __('Define how you would like this string matched.  If using the SQL Expression type you may use any valid SQL expression to generate the alarm.  Available fields include \'message\', \'facility\', \'priority\', and \'host\'.', 'syslog'),
			'value'         => '|arg1:type|',
			'array'         => $removal_message_types,
			'on_change'     => 'changeTypes()',
			'default'       => 'filter'
		],
		'message' => [
			'friendly_name' => __('Syslog Message Match String', 'syslog'),
			'description'   => __('Enter the matching component of the syslog message, the facility or host name, or the SQL where clause if using the SQL Expression Match Type.', 'syslog'),
			'method'        => 'textarea',
			'textarea_rows' => '2',
			'textarea_cols' => '70',
			'class'         => 'textAreaNotes',
			'value'         => '|arg1:message|',
			'default'       => '',
		],
		'rmethod' => [
			'method'        => 'drop_array',
			'friendly_name' => __('Method of Removal', 'syslog'),
			'value'         => '|arg1:method|',
			'array'         => ['del' => __('Deletion', 'syslog'), 'trans' => __('Transferal', 'syslog')],
			'default'       => 'del'
		],
		'notes' => [
			'friendly_name' => __('Removal Rule Notes', 'syslog'),
			'textarea_rows' => '5',
			'textarea_cols' => '70',
			'description'   => __('Space for Notes on the Removal rule', 'syslog'),
			'method'        => 'textarea',
			'class'         => 'textAreaNotes',
			'value'         => '|arg1:notes|',
			'default'       => '',
		],
		'id' => [
			'method' => 'hidden_zero',
			'value'  => '|arg1:id|'
		],
		'_id' => [
			'method' => 'hidden_zero',
			'value'  => '|arg1:id|'
		],
		'save_component_removal' => [
			'method' => 'hidden',
			'value'  => '1'
		]
	];

	form_start('syslog_removal.php', 'syslog_edit');

	html_start_box($header_label, '100%', false, 3, 'center', '');

	draw_edit_form(
		[
			'config' => ['no_form_tag' => true],
			'fields' => inject_form_variables($fields_syslog_removal_edit, (isset($removal) ? $removal : []))
		]
	);

	html_end_box();

	if (syslog_allow_rule_edits()) {
		form_save_button('syslog_removal.php', '', 'id');
	}

	if (syslog_allow_rule_edits()) {
		print "<input id='syslog_rule_test' class='ui-button ui-corner-all ui-widget' type='button' value='" . __esc('Test rule', 'syslog') . "'>";
		print "<div id='syslog_rule_test_dialog' style='display:none;' title='" . __esc('Rule Test Preview', 'syslog') . "'></div>";
	}

	?>
	<script type='text/javascript'>

	var allowEdits=<?php print syslog_allow_rule_edits() ? 'true' : 'false'; ?>;
	var removalFilterBuilder;
	var removalFilterConfig = {
		fields: <?php print syslog_json_safe([
			'message'     => __('Message', 'syslog'),
			'host'        => __('Host', 'syslog'),
			'program'     => __('Program', 'syslog'),
			'facility_id' => __('Facility', 'syslog'),
			'priority_id' => __('Priority', 'syslog')
		]); ?>,
		operators: {
			message: ['contains', 'begins', 'ends', '=', '!='],
			host: ['=', '!=', 'contains', 'begins', 'ends'],
			program: ['=', '!=', 'contains', 'begins', 'ends'],
			facility_id: ['=', '!='],
			priority_id: ['=', '!=']
		},
		choices: <?php
			$filter_choices = syslog_search_choices();
	print syslog_json_safe([
		'facility_id' => $filter_choices['facility_id'] ?? [],
		'priority_id' => $filter_choices['priority_id'] ?? []
	]);
	?>,
		conditions: <?php print syslog_json_safe($filter_conditions); ?>,
		labels: {
			message: <?php print syslog_json_safe(__('Value', 'syslog')); ?>,
			placeholder: <?php print syslog_json_safe(__('Enter a value', 'syslog')); ?>,
			match: <?php print syslog_json_safe(__('Match', 'syslog')); ?>,
			exclude: <?php print syslog_json_safe(__('Exclude', 'syslog')); ?>,
			remove: <?php print syslog_json_safe(__('Remove condition', 'syslog')); ?>,
			integer: <?php print syslog_json_safe(__('Enter a nonnegative integer', 'syslog')); ?>
		}
	};

	function changeTypes() {
		var filterMode = $('#type').val() == 'filter';
		$('#message').toggle(!filterMode);
		$('#syslog_removal_filter_panel').prop('hidden', !filterMode);
		if ($('#type').val() == 'sql') {
			$('#message').prop('rows', 5);
		} else {
			$('#message').prop('rows', 2);
		}
	}

	$(function() {
		var message = document.getElementById('message');
		var panel = document.createElement('section');
		panel.id = 'syslog_removal_filter_panel';
		panel.className = 'syslogRuleFilterPanel ui-widget-content ui-corner-all';
		panel.setAttribute('aria-label', <?php print syslog_json_safe(__('Removal filter conditions', 'syslog')); ?>);
		var builder = document.createElement('div');
		builder.id = 'syslog_removal_filter_builder';
		builder.className = 'syslogSearchBuilder syslogRuleFilterBuilder';
		builder.setAttribute('aria-label', <?php print syslog_json_safe(__('Removal filter conditions', 'syslog')); ?>);
		panel.appendChild(builder);
		message.insertAdjacentElement('afterend', panel);
		if (!removalFilterConfig.conditions.length && message.value && $('#type').val() != 'filter') {
			removalFilterConfig.conditions = [{join: 'AND', negative: false, field: 'message', operator: 'contains', value: message.value}];
		}
		removalFilterBuilder = new SyslogFilterBuilder(builder, removalFilterConfig);
		$('#type').off('change.syslogRemovalFilter').on('change.syslogRemovalFilter', changeTypes);
		document.getElementById('syslog_edit').addEventListener('submit', function(event) {
			if ($('#type').val() == 'filter' && !removalFilterBuilder.syncTo(message)) {
				event.preventDefault();
				event.stopImmediatePropagation();
			}
		}, true);
		changeTypes();

		if (!allowEdits) {
			$('#syslog_edit').find('select, input, textarea, submit').not(':button').prop('disabled', true);
			removalFilterBuilder.setDisabled(true);
			$('#syslog_edit').find('select').each(function() {
				if ($(this).selectmenu('instance')) {
					$(this).selectmenu('refresh');
				}
			});
		}

		$('#refresh').click(function() {
			applyFilterRemoval();
		});

		$('#clear').click(function() {
			clearFilterRemoval();
		});

		$('#import').click(function() {
			importRemoval();
		});

		$('#removal').submit(function(event) {
			event.preventDefault();
			applyFilterRemoval();
		});

		$('#syslog_rule_test').on('click.syslogRuleTest', function() {
			testSyslogRule('#syslog_edit', '#syslog_rule_test_dialog', <?php print syslog_json_safe(__('Rule Test Preview', 'syslog')); ?>);
		});

		var testRuleButton = $('#syslog_rule_test');
		var saveRow = $('#syslog_edit .saveRow');
		var cancelButton = saveRow.find('.cactiReturnTo');

		if (cancelButton.length) {
			testRuleButton.insertAfter(cancelButton);
		} else {
			testRuleButton.prependTo(saveRow);
		}
	});

	</script>
	<?php
}

/**
 * Display the Syslog Removal Rule filter row.
 *
 * @return void
 */
function syslog_removal_filter(): void {
	global $config, $item_rows;

	?>
	<tr class='even'>
		<td>
		<form id='removal' action='syslog_removal.php'>
			<table class='filterTable'>
				<tr>
					<td>
						<?php print __('Search', 'syslog'); ?>
					</td>
					<td>
						<input type='text' id='filter' size='25' value='<?php print html_escape_request_var('filter'); ?>'>
					</td>
					<td>
						<?php print __('Enabled', 'syslog'); ?>
					</td>
					<td>
						<select id='enabled'>
							<option value='-1'<?php if (get_request_var('enabled') == '-1') {?> selected<?php }?>><?php print __('All', 'syslog'); ?></option>
							<option value='1'<?php if (get_request_var('enabled') == '1') {?> selected<?php }?>><?php print __('Yes', 'syslog'); ?></option>
							<option value='0'<?php if (get_request_var('enabled') == '0') {?> selected<?php }?>><?php print __('No', 'syslog'); ?></option>
						</select>
					</td>
					<td>
						<?php print __('Rules', 'syslog'); ?>
					</td>
					<td>
						<select id='rows'>
							<option value='-1'<?php if (get_request_var('rows') == '-1') {?> selected<?php }?>><?php print __('Default', 'syslog'); ?></option>
							<?php
								if (cacti_sizeof($item_rows)) {
									foreach ($item_rows as $key => $value) {
										print '<option value="' . $key . '"';

										if (get_request_var('rows') == $key) {
											print ' selected';
										} print '>' . $value . "</option>\n";
									}
								}
	?>
						</select>
					</td>
					<td>
						<span>
							<input id='refresh' type='button' value='<?php print __esc('Go', 'syslog'); ?>'>
							<input id='clear' type='button' value='<?php print __esc('Clear', 'syslog'); ?>'>
							<?php if (syslog_allow_rule_edits()) {?><input id='import' type='button' value='<?php print __esc('Import', 'syslog'); ?>'><?php } ?>
						</span>
					</td>
				</tr>
			</table>
			<input type='hidden' id='page' value='<?php print get_filter_request_var('page'); ?>'>
		</form>
		<script type='text/javascript'>
		initSyslogRemoval(<?php print syslog_allow_rule_edits() ? 'true' : 'false'; ?>);
		</script>
		</td>
	</tr>
	<?php
}

/**
 * Display the Syslog Removal Rule list.
 *
 * @return void
 */
function syslog_removal(): void {
	global $syslog_actions, $message_types, $config;
	global $syslogdb_default;

	// ================= input validation and session storage =================
	$filters = [
		'rows' => [
			'filter'  => FILTER_VALIDATE_INT,
			'pageset' => true,
			'default' => '-1',
			],
		'page' => [
			'filter'  => FILTER_VALIDATE_INT,
			'default' => '1'
			],
		'id' => [
			'filter'  => FILTER_VALIDATE_INT,
			'default' => '1'
			],
		'enabled' => [
			'filter'  => FILTER_VALIDATE_INT,
			'pageset' => true,
			'default' => '-1'
			],
		'filter' => [
			'filter'  => FILTER_DEFAULT,
			'pageset' => true,
			'default' => ''
			],
		'sort_column' => [
			'filter'  => FILTER_CALLBACK,
			'default' => 'name',
			'options' => ['options' => 'sanitize_search_string']
			],
		'sort_direction' => [
			'filter'  => FILTER_CALLBACK,
			'default' => 'ASC',
			'options' => ['options' => 'sanitize_search_string']
			]
	];

	validate_store_request_vars($filters, 'sess_syslogr');
	// ================= input validation =================

	if (syslog_allow_rule_edits()) {
		$url = 'syslog_removal.php?action=edit&type=1';
	} else {
		$url = '';
	}

	html_start_box(__('Syslog Removal Rule Filters', 'syslog'), '100%', false, 3, 'center', $url);

	syslog_removal_filter();

	html_end_box();

	$sql_where  = '';
	$sql_params = [];

	if (get_request_var('rows') == -1) {
		$rows = read_config_option('num_rows_table');
	} elseif (get_request_var('rows') == -2) {
		$rows = 999999;
	} else {
		$rows = get_request_var('rows');
	}

	$removals = syslog_get_removal_records($sql_where, $sql_params, $rows);

	$rows_query_string = "SELECT COUNT(*)
		FROM `$syslogdb_default`.`syslog_remove`
		$sql_where";

	$total_rows = syslog_db_fetch_cell_prepared($rows_query_string, $sql_params);

	$display_text = [
		'name'    => [__('Removal Name', 'syslog'), 'ASC'],
		'enabled' => [__('Enabled', 'syslog'), 'ASC'],
		'type'    => [__('Match Type', 'syslog'), 'ASC'],
		'message' => [__('Search String', 'syslog'), 'ASC'],
		'method'  => [__('Method', 'syslog'), 'DESC'],
		'date'    => [__('Last Modified', 'syslog'), 'ASC'],
		'user'    => [__('By User', 'syslog'), 'DESC']
	];

	form_start('syslog_removal.php', 'chk');

	$nav = html_nav_bar('syslog_removal.php?filter=' . get_request_var('filter'), MAX_DISPLAY_PAGES, get_request_var('page'), $rows, $total_rows, cacti_sizeof($display_text) + 1, __('Rules', 'syslog'), 'page', 'main');

	print $nav;

	html_start_box('', '100%', false, 3, 'center', '');

	html_header_sort_checkbox($display_text, get_request_var('sort_column'), get_request_var('sort_direction'));

	if (cacti_sizeof($removals)) {
		foreach ($removals as $removal) {
			form_alternate_row('line' . $removal['id'], true);
			form_selectable_cell(filter_value(title_trim($removal['name'], read_config_option('max_title_length')), get_request_var('filter'), $config['url_path'] . 'plugins/syslog/syslog_removal.php?action=edit&id=' . $removal['id']), $removal['id']);
			form_selectable_cell((($removal['enabled'] == 'on') ? __('Yes', 'syslog') : __('No', 'syslog')), $removal['id']);
			form_selectable_cell($message_types[$removal['type']], $removal['id']);
			form_selectable_ecell(($removal['type'] == 'filter' ? syslog_filter_rule_summary($removal['message']) : $removal['message']), $removal['id']);
			form_selectable_cell((($removal['method'] == 'del') ? __('Deletion', 'syslog') : __('Transfer', 'syslog')), $removal['id']);
			form_selectable_cell(date('Y-m-d H:i:s', $removal['date']), $removal['id']);
			form_selectable_cell($removal['user'], $removal['id']);
			form_checkbox_cell($removal['name'], $removal['id']);
			form_end_row();
		}
	} else {
		print "<tr><td colspan='" . (cacti_sizeof($display_text) + 1) . "'><em>" . __('No Syslog Removal Rules Defined', 'syslog') . '</em></td></tr>';
	}

	html_end_box(false);

	if (cacti_sizeof($removals)) {
		print $nav;
	}

	draw_actions_dropdown($syslog_actions);

	form_end();

	if (isset($_SESSION['exporter'])) {
		syslog_download_frame('syslog_removal.php?action=export&selected_items=' . $_SESSION['exporter']);

		kill_session_var('exporter');
		exit;
	}
}

/**
 * Display the Syslog Removal Rule import form.
 *
 * @return void
 */
function import(): void {
	$form_data = [
		'import_file' => [
			'friendly_name' => __('Import Removal Rule from Local File', 'syslog'),
			'description'   => __('If the XML file containing the Removal Rule definition data is located on your local machine, select it here.', 'syslog'),
			'method'        => 'file'
		],
		'import_text' => [
			'method'        => 'textarea',
			'friendly_name' => __('Import Removal Rule from Text', 'syslog'),
			'description'   => __('If you have the XML file containing the Removal Rule definition data as text, you can paste it into this box to import it.', 'syslog'),
			'value'         => '',
			'default'       => '',
			'textarea_rows' => '10',
			'textarea_cols' => '80',
			'class'         => 'textAreaNotes'
		]
	];

	print "<form method='post' action='syslog_removal.php' enctype='multipart/form-data'>";

	html_start_box(__('Import Removal Rule', 'syslog'), '100%', false, 3, 'center', '');

	draw_edit_form(
		[
			'config' => ['no_form_tag' => true],
			'fields' => $form_data
		]
	);

	html_end_box();

	form_hidden_box('save_component_import', '1', '');

	form_save_button('', 'import', 'id', false);
}

/**
 * Import Syslog Removal Rules from an uploaded file or pasted JSON/XML text.
 *
 * @return void
 */
function removal_import(): void {
	if (!syslog_allow_rule_edits()) {
		die(__('Permission denied.', 'syslog'));
	}

	$import_data = syslog_get_import_xml_payload('syslog_removal.php');

	// obtain debug information if it's set
	$import_array = syslog_parse_rule_import($import_data, 'syslog_remove');

	if ($import_array === false || !$import_array) {
		raise_message('syslog_import_error', __('Import rejected: the file is empty, invalid, or contains a different type of Syslog object.', 'syslog'), MESSAGE_LEVEL_ERROR);
		header('Location: syslog_removal.php');

		return;
	}

	$debug_data = [];

	if ($import_array !== false && cacti_sizeof($import_array)) {
		foreach ($import_array as $template => $contents) {
			$tname = '';
			$save  = [];

			if (cacti_sizeof($contents)) {
				foreach ($contents as $name => $value) {
					switch($name) {
						case 'hash':
							// See if the hash exists, if it does, update the alert
							$found = syslog_db_fetch_cell_prepared('SELECT id
								FROM syslog_remove
								WHERE hash = ?',
								[$value]);

							if (!empty($found)) {
								$save['hash'] = $value;
								$save['id']   = $found;
							} else {
								$save['hash'] = $value;
								$save['id']   = 0;
							}

							break;
						case 'name':
							$tname        = $value;
							$save['name'] = $value;

							break;
						default:
							if (syslog_db_column_exists('syslog_remove', $name)) {
								$save[$name] = $value;
							}

							break;
					}
				}
			}

			$id = syslog_sql_save($save, 'syslog_remove');

			if ($id) {
				raise_message('syslog_info' . $id, __('NOTE: Removal Rule \'%s\' %s!', $tname, ($save['id'] > 0 ? __('Updated', 'syslog') : __('Imported', 'syslog')), 'syslog'), MESSAGE_LEVEL_INFO);
			} else {
				raise_message('syslog_info' . $id, __('ERROR: Removal Rule \'%s\' %s Failed!', $tname, ($save['id'] > 0 ? __('Update', 'syslog') : __('Import', 'syslog')), 'syslog'), MESSAGE_LEVEL_ERROR);
			}
		}
	}

	header('Location: syslog_removal.php');
}