[Wasabules]

Stacked on #101, which is on #100, which is on #99. Each will be retargeted to main as the one below it is merged.

Today, the devices that could use a source rule are found by noticing that their messages look wrong. Settings › Devices lists every address messages arrive from, and marks those devices.

For the user

• One line per address: the addresses heard since SyslogStudio started (or since the service started, while the window drives it), plus those the history holds.
• Columns:
  • Device: address, protocol, and the hostname of its last message. A badge counts the hostnames when there are several behind one address. Its tooltip explains it: a relay, or a device that sends none and has the first word of each message taken for one.
  • Last heard: the time alone for today's messages.
  • Since start and /min: the message counts.
  • Stored: what the history holds for that address.
  • Reading: badges for the rule that reads it, the share of messages whose header bends the RFCs, no priority, no hostname, or standard.
• Marked devices: a device that bends the RFCs or sends no hostname, and that no rule reads, gets a mark in the margin. Only those that could use a rule lists just them.
• The button on each line opens the rule editor on the rule that reads the device (Its rule…, by address, CIDR or pattern since fix(filters): a whole address is that address; CIDR and patterns too #99), or on a new rule for its address (Read differently…). The preview uses its latest live messages, or at least its last message as received when the live view holds none.
• Filter and sort: a filter by address or hostname; sorting by last heard, messages, per minute, stored or address. Count again starts the counts from zero.

How

• sources.Inventory counts what the reader reads as messages arrive (Reader.Read). It does not count what is read again (ReadAt, feat(sources): read stored messages again with the rules #100) or tried in the editor (Try).
  • For each address: messages since start and in the last minute (6 slots of 10 s); first and last heard; protocol; hostname and application of the last message; the different hostnames read lately (up to 8, the last first).
  • Also: how many had a non-standard header, no priority, or no hostname once read; the rule that read the last one, and how many a rule read; the last raw message, cut to 400 bytes.
  • Bounded to 5,000 addresses: a scan from a whole network is not kept forever.
• On Backend: GetSourceDevices and ClearSourceDevices. A window driving the service shows the service's inventory, sealing service included, since that service is what receives.
• The Stored column: the tab reads the history's counts per address with the existing QueryMessageGroups(…, "sourceIP").

Tests

• internal/sources:
  • a standard sender, a relay with several hostnames, a camera read by its rule, key=value after a priority;
  • the per-minute count, and what it says two minutes later;
  • re-reading and trying are not counted;
  • clearing;
  • the bound: devices beyond it are not kept, and those kept keep counting;
  • cut on a character boundary.
• internal/engine: what the reader reads is listed by address, and clearing works.
• UI checked through the screenshot bridge in both themes. The table first overflowed, so address and hostname now share one Device column.

Checked: go vet (Windows, Linux), staticcheck, go test -race ./..., svelte-check --fail-on-warnings, npm test, npm run build, the docs' links.