@@ -11,12 +11,18 @@ entries and record them to their own tables.

 The db needs to be precreated with this schema:

+#+BEGIN_SRC SQL

 create table messages (severity int, facility int, tag text, pid int, message text, host text, ts datetime default current_timestamp);

 create table dns_query (query_type text, request text, requester text, added text default current_timestamp);

 create table dns_reply (query text, reply text, added datetime default current_timestamp);

+#+END_SRC

 * TODO

 - other db backends

 - customizable db paths

+- batch db updates

+- improve filtering command line options

+- TUI / CLIM ui

+  

@@ -9,6 +9,11 @@

 	 (result (dbi:execute query severity facility tag pid message host)))

     result))

+(defun log-untagged-to-sqlite (db &key line)

+  (let* ((db-query (dbi:prepare db "insert into untagged (data) values (?)"))

+	 (result (dbi:execute db-query line)))

+    result))

+

 (defun log-dnsquery-to-sqlite (db &key query-type query from)

   (let* ((db-query (dbi:prepare db "insert into dns_query (query_type, request, requester) values (?,?,?)"))

 	 (result (dbi:execute db-query query-type query from)))

@@ -1,3 +1,7 @@

+;; This Source Code Form is subject to the terms of the Mozilla Public

+;; License, v. 2.0. If a copy of the MPL was not distributed with this

+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.

+

 (in-package #:syslog_helper)

 (define-codecs facility ()

@@ -46,6 +50,14 @@

   (:method (tag metadata message orig-line)

     (declare (ignore tag metadata message))))

+(:method (tag metadata message orig-line)

+    (declare (ignore tag metadata message)))

+

+(defmethod handle-log-message :before ((tag (eql :untagged)) metadata message orig-line)

+  (declare (ignore metadata message))

+  (dbi:with-connection (db :sqlite3 :database-name "/tmp/logs.db")

+      (log-untagged-to-sqlite db :line orig-line)))

+

 (defmethod handle-log-message ((tag (eql :dnsmasq)) metadata message orig-line)

   (let* ((parsed-query (smug:parse (.dnsmasq-query) message))

 	 (parsed-reply (unless parsed-query