#!/usr/bin/perl -w
# 
# syslog.monitor - monitors incoming syslog packets and reports to mon
#
# Author: Lars Marowsky-Bre, lars@marowsky-bree.de
#
# Copyright (C) 1999 Lars Marowsky-Bre
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
#
### Nothing to see below this line.
### Abandon hope all ye who enter here
### Here be dragons!
#############################################################################
# Me, use modules? no, me never use modules
package main;
use strict;
use Socket;
use Net::hostent;
use Time::HiRes qw (time alarm sleep gettimeofday);
use Mon::Client;
use POSIX qw(setsid strftime);

# automagically inserted by CVS
my $VERSION = '$Id: syslog.monitor,v 1.2 2004/11/15 14:45:19 vitroth Exp $';

#############################################################################
# Global variables
# Map syslog facility numbers to names
my %Num2Facility = ( 0 => 'kern', 1 => 'user', 2 => 'mail', 3 => 'daemon', 4
   => 'auth', 5 => 'syslog', 6 => 'lpr', 7 => 'news', 8 => 'uucp', 9 =>
   'cron', 10 => 'authpriv', 11 => 'ftp', 12 => 'reserved-12', 13 =>
   'reserved-13', 14 => 'reserved-14', 15 => 'reserved-15', 16 => 'local0',
   17 => 'local1', 18 => 'local2', 19 => 'local3', 20 => 'local4', 21 =>
   'local5', 22 => 'local6', 23 => 'local7', );
# Map syslog level numbers to names
my %Num2Level = ( 0 => 'emerg', 1 => 'alert', 2 => 'crit', 3 => 'err', 4 =>
   'warn', 5 => 'notice', 6 => 'info', 7 => 'debug' );

# Contains a list of LogEntry object init params
my %Checks = ();
# Hash of hostgroup members hostnames, indexed by hostgroup name
my %GROUP_MEMBERS;
# IP -> hostname resolving
my %IP2Host;
# IP -> hostgroup resolving
my %IP2Group;
# array of references to LogEntry objects, indexed by hostname
my %ChecksPerHost;
# array of references to LogEntry objects per hostgroup
my %ChecksPerGroup;
# Global Mon::Client object
my $mon;
# The configuration is read into this hash
my %CONF;

#############################################################################
# Setup
my ($conf_file) = @ARGV;

if (!defined($conf_file) || $conf_file eq "") 
   { die "No configuration file given"; }

&ReadConf($conf_file);

if ($CONF{'daemon_mode'} == 1) {
   if ($CONF{'logfile'} ne '') {
      &daemonize;
   } else {
      &Log(2,"You can't summon a daemon while talking to the public");
   }
}

# We need some information from the mon server now...
&ChatMonServer;
# Parse the hosts, resolve them etc
&ParseHosts;
# Build the cache, precompile the checks
&BuildChecks;

# Open listener port
my $proto = getprotobyname('udp');
socket(SOCKET, Socket::PF_INET, Socket::SOCK_DGRAM, $proto)
  || die "Could not create listening socket: $!";
bind(SOCKET, scalar Socket::sockaddr_in($CONF{'bind_port'},  
             Socket::inet_aton($CONF{'bind_ip'})))
  || die "Could not bind authentication socket: $!";

# prepare to select
my ($whence,$line,$rin,$rout);
$rin = ''; 
vec($rin, fileno(SOCKET), 1) = 1;
	   
# At which time we did the last full walk of the chains
my $last_full_walk = time;
# Msg - contains the currently processed message
# LastMsg - contains the last Msg hash, per host 
my (%LastMsg,%Msg);

#############################################################################

LOOP: while (1) {
  if (!select($rout = $rin, undef, undef, $CONF{'select_timeout'})) {
     &Log(7,"select timeout");
     next LOOP;
  }
  
  # Read the incoming UDP packet
  if (!($whence = recv(SOCKET, $line, 8192, 0) )) {
     &Log(3,"recv error: $!");
     next LOOP;
  }
  
  # Parse the incoming UDP packet envelope
  my ($src_port,$src_ip) = sockaddr_in($whence);
  $src_ip = inet_ntoa($src_ip);
  chomp($line);
  
  &Log(7,"Received syslog message from $src_ip");
  
  # If this IP does not resolve to a hostname, it is bogus
  if (!defined($IP2Host{$src_ip})) {
     &Log(3,"Received unauthorized message from $src_ip, ignoring");
	 next LOOP;
  }
  
  my ($level,$facility,$msg);
  if ($line =~ /^\<(\d+)\>([^:]+): (.*)$/o) {
     # Decode the message
     %Msg = ();
     $Msg{'src_port'} = $src_port;
	 $Msg{'src_ip'} = $src_ip;
	 $Msg{'host'} = $IP2Host{$src_ip};
	 $Msg{'level'} = $1 & 7; 
	 $Msg{'Level'} = $Num2Level{$1 & 7}; 
	 $Msg{'facility'} = $Num2Facility{$1 >> 3}; 
	 $Msg{'msg'} = $3;
 	 $Msg{'time'} = time;
	 $Msg{'group'} = $IP2Group{$src_ip};
     
	 # Log the message if necessary
	 &OwnLog(\%Msg);

     # Walk through the processing hooks here...
	 my $check;
PER_HOST: foreach $check (@{$ChecksPerHost{ $Msg{'host'} }}) {
	    if ($check->check(\%Msg) == 1) {
		   last PER_HOST;
		}
	 }
	 
PER_GROUP: foreach $check (@{$ChecksPerGroup{ $Msg{'group'}}}) {
	    if ($check->check(\%Msg) == 1) {
		   last PER_GROUP;
		}
	 }
     # Store message for further reference
	 %{$LastMsg{$src_ip}} = %Msg;
	 	 
  } elsif ($line =~ /^last message repeated (\d+) times$/o) {
     my $count = $1;
	 # Handle repetition - last msg from the host is still available
	 # in %LastMsg{$src_ip}
	 
	 &Log(7,"Last message repeated $count times");
  } else {
     &Log(2,"Unknown input ignored: $line");
  }
  
} continue {
  # Before continuing, always check if the checks need to be run,
  # so that the low threshold can be triggered
  
  if ($last_full_walk - time > $CONF{'full_walk_timeout'}) {
     &Log(7,"Full walk triggered after $CONF{'full_walk_timeout'} seconds");
	 
     my ($check_ary);
	 foreach $check_ary (@ChecksPerHost{keys %ChecksPerHost},
	                     @ChecksPerGroup{keys %ChecksPerGroup}
	                    ) {
	    my ($check);
		foreach $check (@$check_ary) {
		  &Log(7,"Running for ".$check->{'group'}."/".$check->{'host'});
		       $check->check({'level' => 7, 'Level' => $Num2Level{7}, 
			   'msg' => 'SYSLOG.MONITOR: SELECT TIMEOUT',
			   'time' => time,
			 });
	    } # foreach $check
	 } # foreach $check_ary
  } # if
} # continue

#############################################################################

sub BuildChecks {
	&Log(6,"Building check cache, precompiling objects");
	
	# First, build the per-host cache
	my ($group);
	foreach $group (keys %{$CONF{'checks-per-host'}}) {
	
	   if (defined($GROUP_MEMBERS{$group})) {
		  # Build the "per-host" checks
		  my ($host);
		  foreach $host (@{$GROUP_MEMBERS{$group}}) {
	        &Log(6,"Building per host checks for $group/$host");
			
			my ($check);
CHECK:		foreach $check (@{$CONF{'on-host'}{$group}{$host}},@{$CONF{'checks-per-host'}{$group}}) {
			   if (!defined($Checks{$check})) {
			     &Log(3,"Undefined check $check for $host, ignoring");
			     next CHECK;
			   }
			   push @{$ChecksPerHost{$host}},LogEntry->new($Checks{$check},$group,$host);
		    }
		  }
	   } else {
	     &Log(3,"Unknown hostgroup $group referenced in config file");
	   }
	}
	
	# Second, build the per-group cache
	foreach $group (keys %{$CONF{'checks-per-group'}}) {
	   if (defined($GROUP_MEMBERS{$group})) {
	       &Log(6,"Building per group checks for $group");
		   my $check;
CHECK:	   foreach $check (@{$CONF{'checks-per-group'}{$group}}) {
             if (!defined($Checks{$check})) {
			    &Log(3,"Undefined check $check for group $group, ignoring");
				next CHECK;
			 }
			 push @{$ChecksPerGroup{$group}},LogEntry->new($Checks{$check},$group,'ALL');
		   }
	   } else {
	     &Log(3,"undefined group $group, ignoring");
		 next GROUP;
	   }
	}
	&Log(6,"Finished building check cache");
}

sub FormatTime {
    # Prints the time like a proper Cisco
    my ($time) = @_;
	return strftime("%b %e %H:%M:%S", localtime($time))
	       .sprintf(".%03d",($time - int($time)) * 1000 );
}

# Log a message if the priority is high enough
sub Log {
    my ($prio,$msg) = @_;
	
	if ($prio <= $CONF{'loglevel'}) {
	   my $line = &FormatTime(time).
	            sprintf(": %- 6.6s: %s\n",
	              $Num2Level{$prio},$msg);
	   if ($CONF{'logfile'} ne "") {
	      open(LOG,">>$CONF{'logfile'}") || die "Could not open logfile!";
	      print LOG $line;
		  close(LOG);
	   } else {
	      print $line;
	   }
	}
}

sub OwnLog {
    # Log the message to the file specified in syslog.conf
    my ($r) = @_;

    return if ($CONF{'syslogfile'} eq "");
    
	my $f = $CONF{'syslogfile'};
	
	# Ok, logfile is defined. do the substitutions
	
	my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($$r{'time'});
	$year += 1900;
	
	print $f."\n";
	
	$f =~ s/\%H/$$r{host}/;
	$f =~ s/\%L/$$r{Level}/;
	$f =~ s/\%l/$$r{level}/;
	$f =~ s/\%F/$$r{facility}/;
	$f =~ s/\%G/$$r{group}/;
	$f =~ s/\%D/sprintf "%04d-%02d-%02d",$year,$mon,$mday/e;
    
	# Make sure everything is still okay
	$f =~ s/[^A-Za-z0-9\.\-\/]//og;
	
	open(F,">>$f");
	
	print F &FormatTime($$r{'time'}).sprintf(" %s %s.%s: %s\n", $$r{'host'},
	                        $$r{'facility'},$$r{'Level'},$$r{'msg'});
	
	close(F);
}


sub ChatMonServer {
    # Setup the mon connection
    $mon = Mon::Client->new(
	     host => $CONF{'mon_host'},
		 username => $CONF{'mon_user'},
		 password => $CONF{'mon_pass'});
	&Log(6,"Connecting to mon host $CONF{'mon_host'}");
	
	# Retrieve information from the mon server about hostgroups
	if (!defined ($mon->connect)) {
   	   &Log(2,"Could not connect to server: " . $mon->error);
	   die;
	}
	
	my %opstatus;
	if (!(%opstatus = $mon->list_opstatus)) {
       &Log(2,"could not get opstatus: " . $mon->error);
	   $mon->disconnect;
	   die;
	}
	
	# We are only interested in hostgroups which have the "syslog" service
	# defined, and thus are able to process our traps
	my ($group);
	foreach $group (keys %opstatus) {
	   if (defined($opstatus{$group}{'syslog'})) {
	      my (@hosts) = $mon->list_group($group);
		  @{$GROUP_MEMBERS{$group}} = @hosts;
	   }
	}
	
	# We don't need the TCP connection anymore from here on.
	# This might change in the future if Mon::Client ever sends
	# traps via tcp
	$mon->disconnect;
}

# Parse the hostnames, and fill in the %IP2Host / %IP2Group
sub ParseHosts {
    my ($group,$host);
	
	&Log(6,"Resolving hostnames and building cache");
	foreach $group (keys %GROUP_MEMBERS) {
HOST:	   foreach $host (@{$GROUP_MEMBERS{$group}}) {
	     my $h = gethostbyname($host);
		 if (!defined($h)) {
		    &Log(3,"Failed to resolve $host, ignoring");
		    next HOST;
		 }
		 
		 if (@{$h->addr_list} > 1 ) {
		    my $addr;
		    for $addr ( @{$h->addr_list} ) {
		        $IP2Host{inet_ntoa($addr)} = $host;
		        $IP2Group{inet_ntoa($addr)} = $group;
		    }
		 } else {
		   $IP2Host{inet_ntoa($h->addr)} = $host;
		   $IP2Group{inet_ntoa($h->addr)} = $group;
		 }
	  }
	}
}

# Send a trap to the mon server
sub SendTrap {
    my ($l) = @_;

	my ($typ,$opstatus,$sum,$dtl);
	if ($l->{status} == 0) {
	   $opstatus = 'ok';
	   $sum = $l->{host}.": ".$l->{desc}." ok since "
	         .localtime($l->{status_time});
	   $dtl = "\nHappened ".scalar(@{$l->{matches}})." within "
	         .$l->{period}."s";
	} elsif ($l->{status} == -1) {
	   $opstatus = 'fail';
	   $sum = $l->{host}.": ".$l->{desc}." occured too seldom since "
	         .localtime($l->{status_time});
	   $dtl = "\nLast time was "
	         .localtime($l->{last_match});
	} elsif ($l->{status} == 1) {
	   $opstatus = 'fail';
	   $sum = $l->{host}.": ".$l->{desc}." occured too often since "
	         .localtime($l->{status_time});
	   $dtl = "\nHappened ".scalar(@{$l->{matches}})." within "
	         .$l->{period}."s\n";
	   # Include copy of the line which triggered the trap
	   $dtl .= ${$l->{'last_matched_msg'}}{'msg'}."\n";
	} else {
	   &Log(0,"BUG: Unknown status in SendTrap");
	   return undef;
	}

    &Log(4,"Sending trap: ".$l->{'group'}." $opstatus $sum");
    # Send the trap
    $mon->send_trap(
	    group => $l->{'group'},
		service => 'syslog',
		retval => 1,
		opstatus => $opstatus,
		summary => $sum,
		detail => $dtl) || &Log(2, "trap sending failed: ".$mon->error);
}

sub ReadConf {
    my ($conf) = @_;

    if ($conf !~ /^[a-z0-9\.\-\/]+$/oi) {
	   &Log(1,"Security violation: $conf contains illegal characters");
	   die;
	}
	
	# Setup defaults
	%CONF = ( 
	   'select_timeout' => 10,
	   'full_walk_timeout' => 30,
	   'bind_ip' => '0.0.0.0',
	   'bind_port' => 514,
	   'logfile' => '',
	   'daemon_mode' => 0,
	   'syslogfile' => "",
	);
	
	if (!open(CONF,"<$conf")) {
	   &Log(2,"Failed to open configuration file");
	   die;
	}
	
	my ($l,$lineno);
	my $level = 'global';
    my ($CHECKNAME,$GROUPNAME);
	
	while (defined($l = <CONF>)) {
	   chomp $l;
	   $l =~ s/^\s*//;
	   $l =~ s/\s*$//;
	   $lineno++;
	   
	   next if $l =~ /^#/;
       
	   if ($level eq 'global') {
	      if ($l =~ /^full_walk_timeout\s+(.*)$/o) {
	         $CONF{'full_walk_timeout'} = &dhmstos($1);
			 next;
	      } elsif ($l =~ /^select_timeout\s+(.*)$/o) {
	        $CONF{'select_timeout'} = &dhmstos($1);
		    next;
	      } elsif ($l =~ /^loglevel\s+(\d)$/o) {
	        $CONF{'loglevel'} = $1;
		    next;
	      } elsif ($l =~ /^logfile\s+([a-z0-9\.\-\/]*)$/io) {
	        $CONF{'logfile'} = $1;
		    next;
	      } elsif ($l =~ /^syslogfile\s+([\%a-z0-9\.\-\/]+)$/io) {
	        $CONF{'syslogfile'} = $1;
		    next;
	      } elsif ($l =~ /^daemon_mode\s*$/o) {
	        $CONF{'daemon_mode'} = 1;
		    next;
		  } elsif ($l =~ /^bind_ip\s+(\d+\.\d+\.\d+\.\d+)$/o) {
	        $CONF{'bind_ip'} = $1;
		    next;
		  } elsif ($l =~ /^bind_port\s+(\d+)$/o) {
	        $CONF{'bind_port'} = $1;
		    next;
	      } elsif ($l =~ /^mon_host\s+(\S+)$/o) {
	        $CONF{'mon_host'} = $1;
		    next;
	      } elsif ($l =~ /^mon_user\s+(\S+)$/o) {
	        $CONF{'mon_user'} = $1;
		    next;
	      } elsif ($l =~ /^mon_pass\s+(\S+)$/o) {
	        $CONF{'mon_pass'} = $1;
			next;
	      } elsif ($l =~ /^check\s+(\S+)$/o) {
		    $level = 'check';
			$CHECKNAME = lc($1);
			$Checks{$CHECKNAME} = {
			  'name' => lc($1),
			  'period' => 300,
			  'min' => -1,
			  'max' => 1,
			  'final' => 0,
			  'desc' => 'I was too lazy to write a proper configuration file',
			};
			next;
		  } elsif ($l =~ /^group\s+(.*)$/o) {
		    $level = 'group';
			$GROUPNAME = $1;
			next;
		  } elsif ($l eq "") {
		    next;
		  }
################ END GLOBAL CONFIGURATION FILE OPTIONS
	   } elsif ($level eq 'check') {
	     if ($l =~ /^period\s+(.*)$/o) {
		    $Checks{$CHECKNAME}{'period'} = &dhmstos($1);
			next;
		 } elsif ($l =~ /^min\s+(\-?\d+)$/o) {
		   $Checks{$CHECKNAME}{'min'} = $1;
		   next;
		 } elsif ($l =~ /^max\s+(\-?\d+)$/o) {
		   $Checks{$CHECKNAME}{'max'} = $1;
		   next;
		 } elsif ($l =~ /^desc\s+(.*)$/o) {
		   $Checks{$CHECKNAME}{'desc'} = $1;
		   next;
		 } elsif ($l =~ /^pattern\s+(.*)$/o) {
		   $Checks{$CHECKNAME}{'pattern'} = $1;
		   next;
		 } elsif ($l =~ /^final\s*$/o) {
		   $Checks{$CHECKNAME}{'final'} = 1;
		   next;
		 } elsif ($l eq "") {
		   # blank line indicates end of check block
		   $level = 'global';
		   $CHECKNAME = '';
		   next;
		 }
#### END OF "CHECK" part
	   } elsif ($level eq 'group') {
	     if ($l =~ /^per-host\s+(.*)$/o) {
		    @{$CONF{'checks-per-host'}{$GROUPNAME}} = split(/\s+/,$1);
		    next;
		 } elsif ($l =~ /^per-group\s+(.*)$/o) {
		    @{$CONF{'checks-per-group'}{$GROUPNAME}} = split(/\s+/,$1);
			next;
		 } elsif ($l =~ /^on-host\s+(\S+)\s+(.*)$/o) {
		    @{$CONF{'on-host'}{$GROUPNAME}{$1}} = split(/\s+/,$2);
			next;
		 } elsif ($l eq "") {
		   $level = 'global';
		   $GROUPNAME = '';
		   next;
		 }
	   }
   
	   &Log(3,"Error while parsing configuration file, line $lineno: $l");
	}
}

#
# convert a string like "20m" into seconds
#
sub dhmstos {
    my ($str) = @_;
    my ($s);

    if ($str =~ /^\s*(\d+(?:\.\d+)?)([dhms])\s*$/i) {
	if ($2 eq "m") {
	    $s = $1 * 60;
	} elsif ($2 eq "h") {
	    $s = $1 * 60 * 60;
	} elsif ($2 eq "d") {
	    $s = $1 * 60 * 60 * 24;
	} else {
	    $s = $1;
	}
    } else {
    	return undef;
    }
    $s;
}

sub daemonize {
    chdir '/'                 or die "Can't chdir to /: $!";
	open STDIN, '/dev/null'   or die "Can't read /dev/null: $!";
	open STDOUT, '>/dev/null' or die "Can't write to /dev/null: $!";
	defined(my $pid = fork)   or die "Can't fork: $!";
	exit if $pid;
	setsid                    or die "Can't start a new session: $!";
	open STDERR, '>&STDOUT'   or die "Can't dup stdout: $!";
}

##############################################################################

package LogEntry;
# Some of the more important stuff happens here

use strict;
use Time::HiRes qw (time alarm sleep);

BEGIN {
      use Exporter   ();
	  use vars       qw($VERSION @ISA @EXPORT @EXPORT_OK %EXPORT_TAGS);

      # set the version for version checking
	  $VERSION     = 0.01;
	  @ISA         = qw(Exporter);
	  @EXPORT      = qw();
	  %EXPORT_TAGS = ( );     # eg: TAG => [ qw!name1 name2! ],
	  
	  # your exported package globals go here,
	  # as well as any optionally exported functions
	  @EXPORT_OK   = qw();
	  }

use vars      @EXPORT_OK;

# non-exported package globals go here
use vars      qw();

sub new {
    my $proto = shift;
	my $class = ref($proto) || $proto;
	my $self  = {
	};
	
	bless ($self, $class);
	
	# Initialise with remaining arguments
	if (@_) {
	$self->init(@_);
	}
	
	return $self;
}

sub init (\%$$) {
    my ($self,$INIT,$group,$host) = @_;
	
	# We load some values from the INIT hash
	%{$self} = %{$INIT};

	# After changing the pattern, it is sensible to reset our counters
	@{$self->{matches}} = (); 

	$self->{group} = $group;
	$self->{host} = $host;
    
	# 0  : did not trigger
	# -1 : triggered because of too few matches
	# 1  : triggered because of too many matches
	$self->{status} = 0;
	$self->{status_time} = time;
	$self->{last_match} = 0;
	
	# The checkitem is a piece of code which we precompile here.
	
	my $code = 'sub { my ($r)=@_; if ('.$$INIT{'pattern'}
	          .') { return 1; } else { return 0 } }';
    
	&::Log(7,"Compiling: $code");
	$self->{matcher} = eval $code;
	if ($@) { &::Log(2,"Error while compiling ".$$INIT{'name'}." ignoring");
	          $self->{matcher} = sub { return 0; };
	}
			
	return $self->{matcher};
}

sub check {
    my ($self,$msg) = @_;
    
	&::Log(7,"Checking ".$self->{desc});
	my $code;
	
	eval { 
	   $code = &{$self->{matcher}}($msg); 
	};
	
	if ($@) { 
	   &::Log(2,"$self->{desc}: Fatal error while matching: $@");
	   return 0;
	}

	my $t = time;

	# Trim our data backlog
	while ( (scalar(@{$self->{matches}})>0) 
	   && ($t-$self->{matches}[0] > $self->{period})) 
	{ shift @{$self->{matches}} }

	if ($code == 1) {
	   &::Log(7,"$self->{desc}: Matched");
	   # Pattern matched. Record timestamp.
	   push @{$self->{matches}},$t;
	   $self->{last_match} = $t;
	   # Keep a copy of the last match
	   %{$self->{last_matched_msg}} = %{$msg}; 
    }
	
	my $count = scalar(@{$self->{matches}});
	my $age = $t-$self->{status_time};
	
	# First, we check if we matched too often. We don't check for
	# the age here since nothing is going to magically lower the match
	# counter.
	if (($count > $self->{max})) {
       &::Log(7,"$self->{desc}: Matched too often within period");
	   $self->trigger(1);
	# if we are below the threshold, and our age is at least
	# period (we need to check for the age - otherwise, we might
	# later on receive more messages and be alright / too high)
    } elsif (($count < $self->{min}) && ($age >= $self->{period})) {
	     &::Log(7,"$self->{desc}: Matched too seldom within period");
		 $self->trigger(-1);
	# same in blue for the "ok" condition
	} elsif (($count > $self->{min}) && ($age >= $self->{period})) {
	     &::Log(7,"$self->{desc}: Roger");
	     $self->trigger(0);
	} 
	
	&::Log(7,"$self->{desc}: Current counter: $count");
	
	# Abort processing if we are a final check and matched
	if ( ($code == 1) && ($self->{'final'} == 1) ) {
       &::Log(7,"$self->{desc}: Terminating walk due to final check");
	   return 1;
    } else {
       return 0;
    }
	
	&::Log(0,"Here are dragons");
	die;
}


sub trigger {
    my ($self,$status) = @_;
	
	return if ($status == $self->{status});
	
    &::Log(6,"$self->{desc}: Status change: ".$self->{status}."->".$status
	      ." Counter: ".scalar(@{$self->{matches}}));
	$self->{status} = $status;
	$self->{status_since} = time;
	
	# We had a status change and need to send the right trap
	&::SendTrap($self);
}