--- zabbix-2.2.0/src/zabbix_agent/active.c.orig	2013-11-21 13:14:58.827578956 +0900
+++ zabbix-2.2.0/src/zabbix_agent/active.c	2013-11-21 14:53:22.961935366 +0900
@@ -789,461 +789,502 @@ out:
 	return ret;
 }
 
-static void	process_active_checks(char *server, unsigned short port)
+static int	pre_process_log(char *server, unsigned short port, int i, int *s_count, int *p_count)
 {
-	const char	*__function_name = "process_active_checks";
-	register int	i, s_count, p_count;
-	char		**pvalue;
-	int		now, send_err = SUCCEED, ret;
+	int		send_err = SUCCEED, ret = FAIL;
 	char		*value = NULL, *item_value = NULL;
 	zbx_uint64_t	lastlogsize;
-	int		mtime;
 	char		params[MAX_STRING_LEN], filename[MAX_STRING_LEN];
 	char		pattern[MAX_STRING_LEN], output_template[MAX_STRING_LEN];
 	/* checks `log', `eventlog', `logrt' may contain parameter, which overrides CONFIG_MAX_LINES_PER_SECOND */
 	char		maxlines_persec_str[16];
 	int		maxlines_persec;
-#ifdef _WINDOWS
-	unsigned long	timestamp, logeventid;
-	unsigned short	severity;
-	char		key_severity[MAX_STRING_LEN], str_severity[32] /* for `regex_match_ex' */;
-	char		key_source[MAX_STRING_LEN], *source = NULL;
-	char		key_logeventid[MAX_STRING_LEN], str_logeventid[8] /* for `regex_match_ex' */;
-	OSVERSIONINFO	versionInfo;
-#endif
 	char		encoding[32];
 	char		tmp[16];
 
-	AGENT_RESULT	result;
+	do
+	{
+		/* simple try realization */
+		if (ZBX_COMMAND_WITH_PARAMS != parse_command(active_metrics[i].key, NULL, 0, params, sizeof(params)))
+			break;
 
-	zabbix_log(LOG_LEVEL_DEBUG, "In %s('%s',%hu)", __function_name, server, port);
+		if (6 < num_param(params))
+			break;
 
-	init_result(&result);
+		if (0 != get_param(params, 1, filename, sizeof(filename)))
+			break;
 
-	now = (int)time(NULL);
+		if (0 != get_param(params, 2, pattern, sizeof(pattern)))
+			*pattern = '\0';
 
-	for (i = 0; NULL != active_metrics[i].key && SUCCEED == send_err; i++)
-	{
-		if (active_metrics[i].nextcheck > now)
-			continue;
+		if (0 != get_param(params, 3, encoding, sizeof(encoding)))
+			*encoding = '\0';
 
-		if (ITEM_STATE_NORMAL != active_metrics[i].state)
-			continue;
+		zbx_strupper(encoding);
 
-		/* special processing for log files without rotation */
-		if (0 == strncmp(active_metrics[i].key, "log[", 4))
-		{
-			ret = FAIL;
+		if (0 != get_param(params, 4, maxlines_persec_str, sizeof(maxlines_persec_str)) ||
+				'\0' == *maxlines_persec_str)
+			maxlines_persec = CONFIG_MAX_LINES_PER_SECOND;
+		else if (MIN_VALUE_LINES > (maxlines_persec = atoi(maxlines_persec_str)) ||
+				MAX_VALUE_LINES < maxlines_persec)
+			break;
 
-			do
-			{
-				/* simple try realization */
-				if (ZBX_COMMAND_WITH_PARAMS != parse_command(active_metrics[i].key, NULL, 0, params, sizeof(params)))
-					break;
+		if (0 != get_param(params, 5, tmp, sizeof(tmp)))
+			*tmp = '\0';
 
-				if (6 < num_param(params))
-					break;
+		if ('\0' == *tmp || 0 == strcmp(tmp, "all"))
+			active_metrics[i].skip_old_data = 0;
+		else if (0 != strcmp(tmp, "skip"))
+			break;
 
-				if (0 != get_param(params, 1, filename, sizeof(filename)))
-					break;
+		if (0 != get_param(params, 6, output_template, sizeof(output_template)))
+			*output_template = '\0';
 
-				if (0 != get_param(params, 2, pattern, sizeof(pattern)))
-					*pattern = '\0';
+		*s_count = 0;
+		*p_count = 0;
+		lastlogsize = active_metrics[i].lastlogsize;
 
-				if (0 != get_param(params, 3, encoding, sizeof(encoding)))
-					*encoding = '\0';
+		while (SUCCEED == (ret = process_log(filename, &lastlogsize, &value, encoding,
+				active_metrics[i].skip_old_data)))
+		{
+			active_metrics[i].skip_old_data = 0;
 
-				zbx_strupper(encoding);
+			/* End of file. The file could become empty, must save `lastlogsize'. */
+			if (NULL == value)
+			{
+				active_metrics[i].lastlogsize = lastlogsize;
+				break;
+			}
 
-				if (0 != get_param(params, 4, maxlines_persec_str, sizeof(maxlines_persec_str)) ||
-						'\0' == *maxlines_persec_str)
-					maxlines_persec = CONFIG_MAX_LINES_PER_SECOND;
-				else if (MIN_VALUE_LINES > (maxlines_persec = atoi(maxlines_persec_str)) ||
-						MAX_VALUE_LINES < maxlines_persec)
-					break;
+			if (SUCCEED == regexp_sub_ex(&regexps, value, pattern, ZBX_CASE_SENSITIVE,
+					output_template, &item_value))
+			{
+				send_err = process_value(server, port, CONFIG_HOSTNAME,
+						active_metrics[i].key_orig, item_value, &lastlogsize,
+						NULL, NULL, NULL, NULL,	NULL, 1);
 
-				if (0 != get_param(params, 5, tmp, sizeof(tmp)))
-					*tmp = '\0';
+				zbx_free(item_value);
 
-				if ('\0' == *tmp || 0 == strcmp(tmp, "all"))
-					active_metrics[i].skip_old_data = 0;
-				else if (0 != strcmp(tmp, "skip"))
-					break;
+				(*s_count)++;
+			}
+			(*p_count)++;
 
-				if (0 != get_param(params, 6, output_template, sizeof(output_template)))
-					*output_template = '\0';
+			zbx_free(value);
 
-				s_count = 0;
-				p_count = 0;
+			if (SUCCEED == send_err)
+				active_metrics[i].lastlogsize = lastlogsize;
+			else
+			{
+				/* buffer is full, stop processing active checks */
+				/* till the buffer is cleared */
 				lastlogsize = active_metrics[i].lastlogsize;
+				return -2;
+			}
 
-				while (SUCCEED == (ret = process_log(filename, &lastlogsize, &value, encoding,
-						active_metrics[i].skip_old_data)))
-				{
-					active_metrics[i].skip_old_data = 0;
+			/* do not flood Zabbix server if file grows too fast */
+			if (*s_count >= (maxlines_persec * active_metrics[i].refresh))
+				break;
 
-					/* End of file. The file could become empty, must save `lastlogsize'. */
-					if (NULL == value)
-					{
-						active_metrics[i].lastlogsize = lastlogsize;
-						break;
-					}
+			/* do not flood local system if file grows too fast */
+			if (*p_count >= (4 * maxlines_persec * active_metrics[i].refresh))
+				break;
+		} /* while processing a log */
+
+	}
+	while (0); /* simple try realization */
 
-					if (SUCCEED == regexp_sub_ex(&regexps, value, pattern, ZBX_CASE_SENSITIVE,
-							output_template, &item_value))
-					{
-						send_err = process_value(server, port, CONFIG_HOSTNAME,
-								active_metrics[i].key_orig, item_value, &lastlogsize,
-								NULL, NULL, NULL, NULL,	NULL, 1);
+	if (FAIL == ret)
+	{
+		active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
+		zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
+				active_metrics[i].key);
 
-						zbx_free(item_value);
+		process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, NULL,
+				&active_metrics[i].lastlogsize, NULL, NULL, NULL, NULL, NULL, 0);
+	}
+	return ret;
+}
 
-						s_count++;
-					}
-					p_count++;
+static int	pre_process_logrt(char *server, unsigned short port, int i, register int *s_count, register int *p_count)
+{
+	int		send_err = SUCCEED, ret = FAIL;
+	char		*value = NULL, *item_value = NULL;
+	zbx_uint64_t	lastlogsize;
+	int		mtime;
+	char		params[MAX_STRING_LEN], filename[MAX_STRING_LEN];
+	char		pattern[MAX_STRING_LEN], output_template[MAX_STRING_LEN];
+	/* checks `log', `eventlog', `logrt' may contain parameter, which overrides CONFIG_MAX_LINES_PER_SECOND */
+	char		maxlines_persec_str[16];
+	int		maxlines_persec;
+	char		encoding[32];
+	char		tmp[16];
 
-					zbx_free(value);
+	do
+	{
+		/* simple try realization */
+		if (ZBX_COMMAND_WITH_PARAMS != parse_command(active_metrics[i].key, NULL, 0, params, sizeof(params)))
+			break;
 
-					if (SUCCEED == send_err)
-						active_metrics[i].lastlogsize = lastlogsize;
-					else
-					{
-						/* buffer is full, stop processing active checks */
-						/* till the buffer is cleared */
-						lastlogsize = active_metrics[i].lastlogsize;
-						goto ret;
-					}
+		if (6 < num_param(params))
+			break;
 
-					/* do not flood Zabbix server if file grows too fast */
-					if (s_count >= (maxlines_persec * active_metrics[i].refresh))
-						break;
+		if (0 != get_param(params, 1, filename, sizeof(filename)))
+			break;
 
-					/* do not flood local system if file grows too fast */
-					if (p_count >= (4 * maxlines_persec * active_metrics[i].refresh))
-						break;
-				} /* while processing a log */
+		if (0 != get_param(params, 2, pattern, sizeof(pattern)))
+			*pattern = '\0';
 
-			}
-			while (0); /* simple try realization */
+		if (0 != get_param(params, 3, encoding, sizeof(encoding)))
+			*encoding = '\0';
 
-			if (FAIL == ret)
-			{
-				active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
-				zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
-						active_metrics[i].key);
+		zbx_strupper(encoding);
 
-				process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, NULL,
-						&active_metrics[i].lastlogsize, NULL, NULL, NULL, NULL, NULL, 0);
-			}
-		}
-		/* special processing for log files with rotation */
-		else if (0 == strncmp(active_metrics[i].key, "logrt[", 6))
-		{
-			ret = FAIL;
+		if (0 != get_param(params, 4, maxlines_persec_str, sizeof(maxlines_persec_str)) ||
+				'\0' == *maxlines_persec_str)
+			maxlines_persec = CONFIG_MAX_LINES_PER_SECOND;
+		else if (MIN_VALUE_LINES > (maxlines_persec = atoi(maxlines_persec_str)) ||
+				MAX_VALUE_LINES < maxlines_persec)
+			break;
 
-			do
-			{
-				/* simple try realization */
-				if (ZBX_COMMAND_WITH_PARAMS != parse_command(active_metrics[i].key, NULL, 0, params, sizeof(params)))
-					break;
+		if (0 != get_param(params, 5, tmp, sizeof(tmp)))
+			*tmp = '\0';
 
-				if (6 < num_param(params))
-					break;
+		if ('\0' == *tmp || 0 == strcmp(tmp, "all"))
+			active_metrics[i].skip_old_data = 0;
+		else if (0 != strcmp(tmp, "skip"))
+			break;
 
-				if (0 != get_param(params, 1, filename, sizeof(filename)))
-					break;
+		if (0 != get_param(params, 6, output_template, sizeof(output_template)))
+			*output_template = '\0';
 
-				if (0 != get_param(params, 2, pattern, sizeof(pattern)))
-					*pattern = '\0';
+		*s_count = 0;
+		*p_count = 0;
+		lastlogsize = active_metrics[i].lastlogsize;
+		mtime = active_metrics[i].mtime;
 
-				if (0 != get_param(params, 3, encoding, sizeof(encoding)))
-					*encoding = '\0';
+		while (SUCCEED == (ret = process_logrt(filename, &lastlogsize, &mtime, &value, encoding,
+				active_metrics[i].skip_old_data)))
+		{
+			active_metrics[i].skip_old_data = 0;
 
-				zbx_strupper(encoding);
+			/* End of file. The file could become empty,*/
+			/* must save `lastlogsize' and `mtime'. */
+			if (NULL == value)
+			{
+				active_metrics[i].lastlogsize = lastlogsize;
+				active_metrics[i].mtime	= mtime;
+				break;
+			}
 
-				if (0 != get_param(params, 4, maxlines_persec_str, sizeof(maxlines_persec_str)) ||
-						'\0' == *maxlines_persec_str)
-					maxlines_persec = CONFIG_MAX_LINES_PER_SECOND;
-				else if (MIN_VALUE_LINES > (maxlines_persec = atoi(maxlines_persec_str)) ||
-						MAX_VALUE_LINES < maxlines_persec)
-					break;
+			if (SUCCEED == regexp_sub_ex(&regexps, value, pattern, ZBX_CASE_SENSITIVE,
+					output_template, &item_value))
+			{
+				send_err = process_value(server, port, CONFIG_HOSTNAME,
+						active_metrics[i].key_orig, item_value, &lastlogsize,
+						&mtime, NULL, NULL, NULL, NULL, 1);
 
-				if (0 != get_param(params, 5, tmp, sizeof(tmp)))
-					*tmp = '\0';
+				zbx_free(item_value);
 
-				if ('\0' == *tmp || 0 == strcmp(tmp, "all"))
-					active_metrics[i].skip_old_data = 0;
-				else if (0 != strcmp(tmp, "skip"))
-					break;
+				(*s_count)++;
+			}
+			(*p_count)++;
 
-				if (0 != get_param(params, 6, output_template, sizeof(output_template)))
-					*output_template = '\0';
+			zbx_free(value);
 
-				s_count = 0;
-				p_count = 0;
+			if (SUCCEED == send_err)
+			{
+				active_metrics[i].lastlogsize = lastlogsize;
+				active_metrics[i].mtime = mtime;
+			}
+			else
+			{
+				/* buffer is full, stop processing active checks */
+				/* till the buffer is cleared */
 				lastlogsize = active_metrics[i].lastlogsize;
 				mtime = active_metrics[i].mtime;
+				return -2;
+			}
 
-				while (SUCCEED == (ret = process_logrt(filename, &lastlogsize, &mtime, &value, encoding,
-						active_metrics[i].skip_old_data)))
-				{
-					active_metrics[i].skip_old_data = 0;
+			/* do not flood Zabbix server if file grows too fast */
+			if (*s_count >= (maxlines_persec * active_metrics[i].refresh))
+				break;
 
-					/* End of file. The file could become empty,*/
-					/* must save `lastlogsize' and `mtime'. */
-					if (NULL == value)
-					{
-						active_metrics[i].lastlogsize = lastlogsize;
-						active_metrics[i].mtime	= mtime;
-						break;
-					}
+			/* do not flood local system if file grows too fast */
+			if (*p_count >= (4 * maxlines_persec * active_metrics[i].refresh))
+				break;
+		} /* while processing a log */
+	}
+	while (0); /* simple try realization */
 
-					if (SUCCEED == regexp_sub_ex(&regexps, value, pattern, ZBX_CASE_SENSITIVE,
-							output_template, &item_value))
-					{
-						send_err = process_value(server, port, CONFIG_HOSTNAME,
-								active_metrics[i].key_orig, item_value, &lastlogsize,
-								&mtime, NULL, NULL, NULL, NULL, 1);
+	if (FAIL == ret)
+	{
+		active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
+		zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
+				active_metrics[i].key);
+
+		process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, NULL,
+				&active_metrics[i].lastlogsize, &active_metrics[i].mtime,
+				NULL, NULL, NULL, NULL, 0);
+	}
+	return ret;
+}
 
-						zbx_free(item_value);
+static int	pre_process_eventlog(char *server, unsigned short port, int i, register int *s_count, register int *p_count)
+{
+	int		ret = FAIL;
+#ifdef _WINDOWS
+	int		send_err = SUCCEED;
+	char		*value = NULL, *item_value = NULL;
+	zbx_uint64_t	lastlogsize;
+	char		params[MAX_STRING_LEN], filename[MAX_STRING_LEN];
+	char		pattern[MAX_STRING_LEN];
+	/* checks `log', `eventlog', `logrt' may contain parameter, which overrides CONFIG_MAX_LINES_PER_SECOND */
+	char		maxlines_persec_str[16];
+	int		maxlines_persec;
+	unsigned long	timestamp, logeventid;
+	unsigned short	severity;
+	char		key_severity[MAX_STRING_LEN], str_severity[32] /* for `regex_match_ex' */;
+	char		key_source[MAX_STRING_LEN], *source = NULL;
+	char		key_logeventid[MAX_STRING_LEN], str_logeventid[8] /* for `regex_match_ex' */;
+	OSVERSIONINFO	versionInfo;
+	char		tmp[16];
 
-						s_count++;
-					}
-					p_count++;
+	do
+	{
+		/* simple try realization */
+		if (ZBX_COMMAND_WITH_PARAMS != parse_command(active_metrics[i].key, NULL, 0, params, sizeof(params)))
+			break;
+
+		if (7 < num_param(params))
+			break;
+
+		if (0 != get_param(params, 1, filename, sizeof(filename)))
+			break;
+
+		if (0 != get_param(params, 2, pattern, sizeof(pattern)))
+			*pattern = '\0';
+
+		if (0 != get_param(params, 3, key_severity, sizeof(key_severity)))
+			*key_severity = '\0';
+
+		if (0 != get_param(params, 4, key_source, sizeof(key_source)))
+			*key_source = '\0';
+
+		if (0 != get_param(params, 5, key_logeventid, sizeof(key_logeventid)))
+			*key_logeventid = '\0';
+
+		if (0 != get_param(params, 6, maxlines_persec_str, sizeof(maxlines_persec_str)) ||
+				'\0' == *maxlines_persec_str)
+			maxlines_persec = CONFIG_MAX_LINES_PER_SECOND;
+		else if (MIN_VALUE_LINES > (maxlines_persec = atoi(maxlines_persec_str)) ||
+				MAX_VALUE_LINES < maxlines_persec)
+			break;
+
+		if (0 != get_param(params, 7, tmp, sizeof(tmp)))
+			*tmp = '\0';
+
+		if ('\0' == *tmp || 0 == strcmp(tmp, "all"))
+			active_metrics[i].skip_old_data = 0;
+		else if (0 != strcmp(tmp, "skip"))
+			break;
+
+		*s_count = 0;
+		*p_count = 0;
+		lastlogsize = active_metrics[i].lastlogsize;
+
+		while (SUCCEED == (ret = process_eventlog(filename, &lastlogsize,
+				&timestamp, &source, &severity, &value, &logeventid,
+				active_metrics[i].skip_old_data)))
+		{
+			active_metrics[i].skip_old_data = 0;
 
-					zbx_free(value);
+			/* End of file. The eventlog could become empty, must save `lastlogsize'. */
+			if (NULL == value)
+			{
+				active_metrics[i].lastlogsize = lastlogsize;
+				break;
+			}
 
-					if (SUCCEED == send_err)
-					{
-						active_metrics[i].lastlogsize = lastlogsize;
-						active_metrics[i].mtime = mtime;
-					}
-					else
-					{
-						/* buffer is full, stop processing active checks */
-						/* till the buffer is cleared */
-						lastlogsize = active_metrics[i].lastlogsize;
-						mtime = active_metrics[i].mtime;
-						goto ret;
-					}
+			versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
+			GetVersionEx(&versionInfo);
 
-					/* do not flood Zabbix server if file grows too fast */
-					if (s_count >= (maxlines_persec * active_metrics[i].refresh))
+			if (versionInfo.dwMajorVersion >= 6)    /* Windows Vista, Windows 7 or Windows Server 2008 */
+			{
+				switch (severity)
+				{
+					case WINEVENT_LEVEL_LOG_ALWAYS:
+					case WINEVENT_LEVEL_INFO:
+						severity = ITEM_LOGTYPE_INFORMATION;
+						zbx_snprintf(str_severity, sizeof(str_severity), INFORMATION_TYPE);
 						break;
-
-					/* do not flood local system if file grows too fast */
-					if (p_count >= (4 * maxlines_persec * active_metrics[i].refresh))
+					case WINEVENT_LEVEL_WARNING:
+						severity = ITEM_LOGTYPE_WARNING;
+						zbx_snprintf(str_severity, sizeof(str_severity), WARNING_TYPE);
 						break;
-				} /* while processing a log */
+					case WINEVENT_LEVEL_ERROR:
+						severity = ITEM_LOGTYPE_ERROR;
+						zbx_snprintf(str_severity, sizeof(str_severity), ERROR_TYPE);
+						break;
+					case WINEVENT_LEVEL_CRITICAL:
+						severity = ITEM_LOGTYPE_CRITICAL;
+						zbx_snprintf(str_severity, sizeof(str_severity), CRITICAL_TYPE);
+						break;
+					case WINEVENT_LEVEL_VERBOSE:
+						severity = ITEM_LOGTYPE_VERBOSE;
+						zbx_snprintf(str_severity, sizeof(str_severity), VERBOSE_TYPE);
+						break;
+				}
 			}
-			while (0); /* simple try realization */
-
-			if (FAIL == ret)
+			else
 			{
-				active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
-				zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
-						active_metrics[i].key);
-
-				process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, NULL,
-						&active_metrics[i].lastlogsize, &active_metrics[i].mtime,
-						NULL, NULL, NULL, NULL, 0);
+				switch (severity)
+				{
+					case EVENTLOG_SUCCESS:
+					case EVENTLOG_INFORMATION_TYPE:
+						severity = ITEM_LOGTYPE_INFORMATION;
+						zbx_snprintf(str_severity, sizeof(str_severity), INFORMATION_TYPE);
+						break;
+					case EVENTLOG_WARNING_TYPE:
+						severity = ITEM_LOGTYPE_WARNING;
+						zbx_snprintf(str_severity, sizeof(str_severity), WARNING_TYPE);
+						break;
+					case EVENTLOG_ERROR_TYPE:
+						severity = ITEM_LOGTYPE_ERROR;
+								zbx_snprintf(str_severity, sizeof(str_severity), ERROR_TYPE);
+						break;
+					case EVENTLOG_AUDIT_FAILURE:
+						severity = ITEM_LOGTYPE_FAILURE_AUDIT;
+						zbx_snprintf(str_severity, sizeof(str_severity), AUDIT_FAILURE);
+						break;
+					case EVENTLOG_AUDIT_SUCCESS:
+						severity = ITEM_LOGTYPE_SUCCESS_AUDIT;
+						zbx_snprintf(str_severity, sizeof(str_severity), AUDIT_SUCCESS);
+						break;
+				}
 			}
-		}
-		/* special processing for eventlog */
-		else if (0 == strncmp(active_metrics[i].key, "eventlog[", 9))
-		{
-			ret = FAIL;
-#ifdef _WINDOWS
-			do
+			zbx_snprintf(str_logeventid, sizeof(str_logeventid), "%lu", logeventid);
+
+			if (SUCCEED == regexp_match_ex(&regexps, value, pattern, ZBX_CASE_SENSITIVE) &&
+					SUCCEED == regexp_match_ex(&regexps, str_severity, key_severity,
+							ZBX_IGNORE_CASE) &&
+					SUCCEED == regexp_match_ex(&regexps, source, key_source,
+							ZBX_IGNORE_CASE) &&
+					SUCCEED == regexp_match_ex(&regexps, str_logeventid,
+							key_logeventid, ZBX_CASE_SENSITIVE))
 			{
-				/* simple try realization */
-				if (ZBX_COMMAND_WITH_PARAMS != parse_command(active_metrics[i].key, NULL, 0, params, sizeof(params)))
-					break;
+				send_err = process_value(server, port, CONFIG_HOSTNAME,
+						active_metrics[i].key_orig, value, &lastlogsize,
+						NULL, &timestamp, source, &severity, &logeventid, 1);
+				(*s_count)++;
+			}
+			(*p_count)++;
 
-				if (7 < num_param(params))
-					break;
+			zbx_free(source);
+			zbx_free(value);
 
-				if (0 != get_param(params, 1, filename, sizeof(filename)))
-					break;
+			if (SUCCEED == send_err)
+						active_metrics[i].lastlogsize = lastlogsize;
+			else
+			{
+				/* buffer is full, stop processing active checks */
+				/* till the buffer is cleared */
+				lastlogsize = active_metrics[i].lastlogsize;
+				return -2;
+			}
 
-				if (0 != get_param(params, 2, pattern, sizeof(pattern)))
-					*pattern = '\0';
+			/* do not flood Zabbix server if file grows too fast */
+			if (*s_count >= (maxlines_persec * active_metrics[i].refresh))
+				break;
 
-				if (0 != get_param(params, 3, key_severity, sizeof(key_severity)))
-					*key_severity = '\0';
+			/* do not flood local system if file grows too fast */
+			if (*p_count >= (4 * maxlines_persec * active_metrics[i].refresh))
+				break;
+		} /* while processing an eventlog */
 
-				if (0 != get_param(params, 4, key_source, sizeof(key_source)))
-					*key_source = '\0';
+		break;
+	}
+	while (0); /* simple try realization */
+#endif	/* _WINDOWS */
 
-				if (0 != get_param(params, 5, key_logeventid, sizeof(key_logeventid)))
-					*key_logeventid = '\0';
+	if (FAIL == ret)
+	{
+		active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
+		zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
+				active_metrics[i].key);
 
-				if (0 != get_param(params, 6, maxlines_persec_str, sizeof(maxlines_persec_str)) ||
-						'\0' == *maxlines_persec_str)
-					maxlines_persec = CONFIG_MAX_LINES_PER_SECOND;
-				else if (MIN_VALUE_LINES > (maxlines_persec = atoi(maxlines_persec_str)) ||
-						MAX_VALUE_LINES < maxlines_persec)
-					break;
+		process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, NULL,
+				&active_metrics[i].lastlogsize, NULL, NULL, NULL, NULL, NULL, 0);
+	}
+	return ret;
+}
 
-				if (0 != get_param(params, 7, tmp, sizeof(tmp)))
-					*tmp = '\0';
+static void	pre_process_others(char *server, unsigned short port, int i)
+{
+	char		**pvalue;
 
-				if ('\0' == *tmp || 0 == strcmp(tmp, "all"))
-					active_metrics[i].skip_old_data = 0;
-				else if (0 != strcmp(tmp, "skip"))
-					break;
+	AGENT_RESULT	result;
 
-				s_count = 0;
-				p_count = 0;
-				lastlogsize = active_metrics[i].lastlogsize;
+	init_result(&result);
 
-				while (SUCCEED == (ret = process_eventlog(filename, &lastlogsize,
-						&timestamp, &source, &severity, &value, &logeventid,
-						active_metrics[i].skip_old_data)))
-				{
-					active_metrics[i].skip_old_data = 0;
+	process(active_metrics[i].key, 0, &result);
 
-					/* End of file. The eventlog could become empty, must save `lastlogsize'. */
-					if (NULL == value)
-					{
-						active_metrics[i].lastlogsize = lastlogsize;
-						break;
-					}
+	if (NULL == (pvalue = GET_TEXT_RESULT(&result)))
+		pvalue = GET_MSG_RESULT(&result);
 
-					versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
-					GetVersionEx(&versionInfo);
+	if (NULL != pvalue)
+	{
+		zabbix_log(LOG_LEVEL_DEBUG, "for key [%s] received value [%s]", active_metrics[i].key,
+				*pvalue);
+		process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, *pvalue, NULL,
+				NULL, NULL, NULL, NULL, NULL, 0);
 
-					if (versionInfo.dwMajorVersion >= 6)    /* Windows Vista, Windows 7 or Windows Server 2008 */
-					{
-						switch (severity)
-						{
-							case WINEVENT_LEVEL_LOG_ALWAYS:
-							case WINEVENT_LEVEL_INFO:
-								severity = ITEM_LOGTYPE_INFORMATION;
-								zbx_snprintf(str_severity, sizeof(str_severity), INFORMATION_TYPE);
-								break;
-							case WINEVENT_LEVEL_WARNING:
-								severity = ITEM_LOGTYPE_WARNING;
-								zbx_snprintf(str_severity, sizeof(str_severity), WARNING_TYPE);
-								break;
-							case WINEVENT_LEVEL_ERROR:
-								severity = ITEM_LOGTYPE_ERROR;
-								zbx_snprintf(str_severity, sizeof(str_severity), ERROR_TYPE);
-								break;
-							case WINEVENT_LEVEL_CRITICAL:
-								severity = ITEM_LOGTYPE_CRITICAL;
-								zbx_snprintf(str_severity, sizeof(str_severity), CRITICAL_TYPE);
-								break;
-							case WINEVENT_LEVEL_VERBOSE:
-								severity = ITEM_LOGTYPE_VERBOSE;
-								zbx_snprintf(str_severity, sizeof(str_severity), VERBOSE_TYPE);
-								break;
-						}
-					}
-					else
-					{
-						switch (severity)
-						{
-							case EVENTLOG_SUCCESS:
-							case EVENTLOG_INFORMATION_TYPE:
-								severity = ITEM_LOGTYPE_INFORMATION;
-								zbx_snprintf(str_severity, sizeof(str_severity), INFORMATION_TYPE);
-								break;
-							case EVENTLOG_WARNING_TYPE:
-								severity = ITEM_LOGTYPE_WARNING;
-								zbx_snprintf(str_severity, sizeof(str_severity), WARNING_TYPE);
-								break;
-							case EVENTLOG_ERROR_TYPE:
-								severity = ITEM_LOGTYPE_ERROR;
-								zbx_snprintf(str_severity, sizeof(str_severity), ERROR_TYPE);
-								break;
-							case EVENTLOG_AUDIT_FAILURE:
-								severity = ITEM_LOGTYPE_FAILURE_AUDIT;
-								zbx_snprintf(str_severity, sizeof(str_severity), AUDIT_FAILURE);
-								break;
-							case EVENTLOG_AUDIT_SUCCESS:
-								severity = ITEM_LOGTYPE_SUCCESS_AUDIT;
-								zbx_snprintf(str_severity, sizeof(str_severity), AUDIT_SUCCESS);
-								break;
-						}
-					}
-					zbx_snprintf(str_logeventid, sizeof(str_logeventid), "%lu", logeventid);
-
-					if (SUCCEED == regexp_match_ex(&regexps, value, pattern, ZBX_CASE_SENSITIVE) &&
-							SUCCEED == regexp_match_ex(&regexps, str_severity, key_severity,
-									ZBX_IGNORE_CASE) &&
-							SUCCEED == regexp_match_ex(&regexps, source, key_source,
-									ZBX_IGNORE_CASE) &&
-							SUCCEED == regexp_match_ex(&regexps, str_logeventid,
-									key_logeventid, ZBX_CASE_SENSITIVE))
-					{
-						send_err = process_value(server, port, CONFIG_HOSTNAME,
-								active_metrics[i].key_orig, value, &lastlogsize,
-								NULL, &timestamp, source, &severity, &logeventid, 1);
-						s_count++;
-					}
-					p_count++;
+		if (0 == strcmp(*pvalue, ZBX_NOTSUPPORTED))
+		{
+			active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
+			zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
+					active_metrics[i].key);
+		}
+	}
 
-					zbx_free(source);
-					zbx_free(value);
+	free_result(&result);
+}
 
-					if (SUCCEED == send_err)
-						active_metrics[i].lastlogsize = lastlogsize;
-					else
-					{
-						/* buffer is full, stop processing active checks */
-						/* till the buffer is cleared */
-						lastlogsize = active_metrics[i].lastlogsize;
-						goto ret;
-					}
+static void	process_active_checks(char *server, unsigned short port)
+{
+	const char	*__function_name = "process_active_checks";
+	int		i, s_count, p_count;
+	int		now, send_err = SUCCEED;
 
-					/* do not flood Zabbix server if file grows too fast */
-					if (s_count >= (maxlines_persec * active_metrics[i].refresh))
-						break;
+	zabbix_log(LOG_LEVEL_DEBUG, "In %s('%s',%hu)", __function_name, server, port);
 
-					/* do not flood local system if file grows too fast */
-					if (p_count >= (4 * maxlines_persec * active_metrics[i].refresh))
-						break;
-				} /* while processing an eventlog */
+	now = (int)time(NULL);
 
-				break;
-			}
-			while (0); /* simple try realization */
-#endif	/* _WINDOWS */
+	for (i = 0; NULL != active_metrics[i].key && SUCCEED == send_err; i++)
+	{
+		if (active_metrics[i].nextcheck > now)
+			continue;
 
-			if (FAIL == ret)
-			{
-				active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
-				zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
-						active_metrics[i].key);
+		if (ITEM_STATE_NORMAL != active_metrics[i].state)
+			continue;
 
-				process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, NULL,
-						&active_metrics[i].lastlogsize, NULL, NULL, NULL, NULL, NULL, 0);
-			}
+		/* special processing for log files without rotation */
+		if (0 == strncmp(active_metrics[i].key, "log[", 4))
+		{
+			if (-2 == pre_process_log(server, port, i, &s_count, &p_count)) goto ret;
+		}
+		/* special processing for log files with rotation */
+		else if (0 == strncmp(active_metrics[i].key, "logrt[", 6))
+		{
+			if (-2 == pre_process_logrt(server, port, i, &s_count, &p_count)) goto ret;
+		}
+		/* special processing for eventlog */
+		else if (0 == strncmp(active_metrics[i].key, "eventlog[", 9))
+		{
+			if (-2 == pre_process_eventlog(server, port, i, &s_count, &p_count)) goto ret;
 		}
 		else
 		{
-			process(active_metrics[i].key, 0, &result);
-
-			if (NULL == (pvalue = GET_TEXT_RESULT(&result)))
-				pvalue = GET_MSG_RESULT(&result);
-
-			if (NULL != pvalue)
-			{
-				zabbix_log(LOG_LEVEL_DEBUG, "for key [%s] received value [%s]", active_metrics[i].key,
-						*pvalue);
-				process_value(server, port, CONFIG_HOSTNAME, active_metrics[i].key_orig, *pvalue, NULL,
-						NULL, NULL, NULL, NULL, NULL, 0);
-
-				if (0 == strcmp(*pvalue, ZBX_NOTSUPPORTED))
-				{
-					active_metrics[i].state = ITEM_STATE_NOTSUPPORTED;
-					zabbix_log(LOG_LEVEL_WARNING, "active check \"%s\" is not supported",
-							active_metrics[i].key);
-				}
-			}
-
-			free_result(&result);
+			pre_process_others(server, port, i);
 		}
 		active_metrics[i].nextcheck = (int)time(NULL) + active_metrics[i].refresh;
 	}