T6641: Add vyos-network-event-logger Service

The service parses and logs network events for improved monitoring and diagnostics.
Supported event types include:

- `RTM_NEWROUTE`, `RTM_DELROUTE`
- `RTM_NEWLINK`, `RTM_DELLINK`
- `RTM_NEWADDR`, `RTM_DELADDR`
- `RTM_NEWNEIGH`, `RTM_DELNEIGH`, `RTM_GETNEIGH`
- `RTM_NEWRULE`, `RTM_DELRULE`

Added operational mode commands for filtered log retrieval:
- `show log network-event <event-type> <interface>`: Retrieve logs filtered by event type and interface.
- `show interfaces <type> <name> event-log <event-type>`: Display interface-specific logs filtered by event type.

22 files changed, 134 insertions, 0 deletions

diff --git a/op-mode-definitions/include/log/network-event-type-interface.xml.i b/op-mode-definitions/include/log/network-event-type-interface.xml.i
new file mode 100644
index 000000000..2d781223c
--- /dev/null
+++ b/op-mode-definitions/include/log/network-event-type-interface.xml.i
@@ -0,0 +1,11 @@
+<!-- included start from network-event-type-interface.xml.i -->
+<tagNode name="interface">
+  <properties>
+    <help>Show log for specific interface</help>
+    <completionHelp>
+      <script>${vyos_completion_dir}/list_interfaces</script>
+    </completionHelp>
+  </properties>
+  <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service | grep "$(echo "\[$4\]" | tr '[:lower:]' '[:upper:]')" | grep "\b$6\b"</command>
+</tagNode>
+<!-- included end -->
diff --git a/op-mode-definitions/include/show-interface-type-event-log.xml.i b/op-mode-definitions/include/show-interface-type-event-log.xml.i
new file mode 100644
index 000000000..c69073fda
--- /dev/null
+++ b/op-mode-definitions/include/show-interface-type-event-log.xml.i
@@ -0,0 +1,40 @@
+<!-- included start from show-interface-type-event-log.xml.i -->
+<node name="event-log">
+  <properties>
+    <help>Show network interface change event log</help>
+  </properties>
+  <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\b$4\b"</command>
+  <children>
+    <leafNode name="route">
+      <properties>
+        <help>Show log for route events</help>
+      </properties>
+      <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\b$4\b" | grep -i "\[$6\]"</command>
+    </leafNode>
+    <leafNode name="link">
+      <properties>
+        <help>Show log for network link events</help>
+      </properties>
+      <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\b$4\b" | grep -i "\[$6\]"</command>
+    </leafNode>
+    <leafNode name="addr">
+      <properties>
+        <help>Show log for network address events</help>
+      </properties>
+      <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\b$4\b" | grep -i "\[$6\]"</command>
+    </leafNode>
+    <leafNode name="neigh">
+      <properties>
+        <help>Show log for neighbor table events</help>
+      </properties>
+      <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\b$4\b" | grep -i "\[$6\]"</command>
+    </leafNode>
+    <leafNode name="rule">
+      <properties>
+        <help>Show log for PBR rule change events</help>
+      </properties>
+      <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\b$4\b" | grep -i "\[$6\]"</command>
+    </leafNode>
+  </children>
+</node>
+<!-- included end -->
diff --git a/op-mode-definitions/show-interfaces-bonding.xml.in b/op-mode-definitions/show-interfaces-bonding.xml.in
index e2950331b..0abb7cd5a 100644
--- a/op-mode-definitions/show-interfaces-bonding.xml.in
+++ b/op-mode-definitions/show-interfaces-bonding.xml.in
@@ -67,6 +67,7 @@
                   </leafNode>
                 </children>
               </tagNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="bonding">
diff --git a/op-mode-definitions/show-interfaces-bridge.xml.in b/op-mode-definitions/show-interfaces-bridge.xml.in
index dc813682d..998dacd38 100644
--- a/op-mode-definitions/show-interfaces-bridge.xml.in
+++ b/op-mode-definitions/show-interfaces-bridge.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=bridge</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="bridge">
diff --git a/op-mode-definitions/show-interfaces-dummy.xml.in b/op-mode-definitions/show-interfaces-dummy.xml.in
index b8ec7da91..18f21e97e 100644
--- a/op-mode-definitions/show-interfaces-dummy.xml.in
+++ b/op-mode-definitions/show-interfaces-dummy.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=dummy</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="dummy">
diff --git a/op-mode-definitions/show-interfaces-ethernet.xml.in b/op-mode-definitions/show-interfaces-ethernet.xml.in
index 09f0b3933..8a23455bf 100644
--- a/op-mode-definitions/show-interfaces-ethernet.xml.in
+++ b/op-mode-definitions/show-interfaces-ethernet.xml.in
@@ -68,6 +68,7 @@
                   </leafNode>
                 </children>
               </tagNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="ethernet">
diff --git a/op-mode-definitions/show-interfaces-geneve.xml.in b/op-mode-definitions/show-interfaces-geneve.xml.in
index d3d188031..b5fe84ca7 100644
--- a/op-mode-definitions/show-interfaces-geneve.xml.in
+++ b/op-mode-definitions/show-interfaces-geneve.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=geneve</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="geneve">
diff --git a/op-mode-definitions/show-interfaces-input.xml.in b/op-mode-definitions/show-interfaces-input.xml.in
index e5d420056..c9856f77f 100644
--- a/op-mode-definitions/show-interfaces-input.xml.in
+++ b/op-mode-definitions/show-interfaces-input.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=input</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="input">
diff --git a/op-mode-definitions/show-interfaces-l2tpv3.xml.in b/op-mode-definitions/show-interfaces-l2tpv3.xml.in
index 2d165171c..88b73d7d7 100644
--- a/op-mode-definitions/show-interfaces-l2tpv3.xml.in
+++ b/op-mode-definitions/show-interfaces-l2tpv3.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=l2tpv3</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="l2tpv3">
diff --git a/op-mode-definitions/show-interfaces-loopback.xml.in b/op-mode-definitions/show-interfaces-loopback.xml.in
index d341a6359..467e1a13d 100644
--- a/op-mode-definitions/show-interfaces-loopback.xml.in
+++ b/op-mode-definitions/show-interfaces-loopback.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=loopback</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="loopback">
diff --git a/op-mode-definitions/show-interfaces-macsec.xml.in b/op-mode-definitions/show-interfaces-macsec.xml.in
index 28264d252..640031b77 100644
--- a/op-mode-definitions/show-interfaces-macsec.xml.in
+++ b/op-mode-definitions/show-interfaces-macsec.xml.in
@@ -29,6 +29,9 @@
               </completionHelp>
             </properties>
             <command>ip macsec show $4</command>
+            <children>
+              #include <include/show-interface-type-event-log.xml.i>
+            </children>
           </tagNode>
         </children>
       </node>
diff --git a/op-mode-definitions/show-interfaces-pppoe.xml.in b/op-mode-definitions/show-interfaces-pppoe.xml.in
index 1c6e0b83e..c1f502cb3 100644
--- a/op-mode-definitions/show-interfaces-pppoe.xml.in
+++ b/op-mode-definitions/show-interfaces-pppoe.xml.in
@@ -28,6 +28,7 @@
                 </properties>
                 <command>if [ -d "/sys/class/net/$4" ]; then /usr/sbin/pppstats "$4"; fi</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="pppoe">
diff --git a/op-mode-definitions/show-interfaces-pseudo-ethernet.xml.in b/op-mode-definitions/show-interfaces-pseudo-ethernet.xml.in
index 4ab2a5fbb..a9e4257ce 100644
--- a/op-mode-definitions/show-interfaces-pseudo-ethernet.xml.in
+++ b/op-mode-definitions/show-interfaces-pseudo-ethernet.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=pseudo-ethernet</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="pseudo-ethernet">
diff --git a/op-mode-definitions/show-interfaces-sstpc.xml.in b/op-mode-definitions/show-interfaces-sstpc.xml.in
index 307276f72..3bd7a8247 100644
--- a/op-mode-definitions/show-interfaces-sstpc.xml.in
+++ b/op-mode-definitions/show-interfaces-sstpc.xml.in
@@ -28,6 +28,7 @@
                 </properties>
                 <command>if [ -d "/sys/class/net/$4" ]; then /usr/sbin/pppstats "$4"; fi</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="sstpc">
diff --git a/op-mode-definitions/show-interfaces-tunnel.xml.in b/op-mode-definitions/show-interfaces-tunnel.xml.in
index b99b0cbb2..579b173cb 100644
--- a/op-mode-definitions/show-interfaces-tunnel.xml.in
+++ b/op-mode-definitions/show-interfaces-tunnel.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=tunnel</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="tunnel">
diff --git a/op-mode-definitions/show-interfaces-virtual-ethernet.xml.in b/op-mode-definitions/show-interfaces-virtual-ethernet.xml.in
index 18ae806b7..4112a17af 100644
--- a/op-mode-definitions/show-interfaces-virtual-ethernet.xml.in
+++ b/op-mode-definitions/show-interfaces-virtual-ethernet.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=virtual-ethernet</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="virtual-ethernet">
diff --git a/op-mode-definitions/show-interfaces-vti.xml.in b/op-mode-definitions/show-interfaces-vti.xml.in
index ae5cfeb9c..d13b3e7cc 100644
--- a/op-mode-definitions/show-interfaces-vti.xml.in
+++ b/op-mode-definitions/show-interfaces-vti.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=vti</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="vti">
diff --git a/op-mode-definitions/show-interfaces-vxlan.xml.in b/op-mode-definitions/show-interfaces-vxlan.xml.in
index fd729b986..89c8d075b 100644
--- a/op-mode-definitions/show-interfaces-vxlan.xml.in
+++ b/op-mode-definitions/show-interfaces-vxlan.xml.in
@@ -19,6 +19,7 @@
                 </properties>
                 <command>${vyos_op_scripts_dir}/interfaces.py show_summary --intf-name="$4" --intf-type=vxlan</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="vxlan">
diff --git a/op-mode-definitions/show-interfaces-wireguard.xml.in b/op-mode-definitions/show-interfaces-wireguard.xml.in
index 0e61ccd74..d86152a21 100644
--- a/op-mode-definitions/show-interfaces-wireguard.xml.in
+++ b/op-mode-definitions/show-interfaces-wireguard.xml.in
@@ -43,6 +43,7 @@
                 </properties>
                 <command>sudo ${vyos_op_scripts_dir}/interfaces_wireguard.py show_summary --intf-name="$4"</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="wireguard">
diff --git a/op-mode-definitions/show-interfaces-wireless.xml.in b/op-mode-definitions/show-interfaces-wireless.xml.in
index 09c9a7895..b0a1502de 100644
--- a/op-mode-definitions/show-interfaces-wireless.xml.in
+++ b/op-mode-definitions/show-interfaces-wireless.xml.in
@@ -73,6 +73,7 @@
                   </leafNode>
                 </children>
               </tagNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
         </children>
diff --git a/op-mode-definitions/show-interfaces-wwan.xml.in b/op-mode-definitions/show-interfaces-wwan.xml.in
index 3682282a3..2301b32d0 100644
--- a/op-mode-definitions/show-interfaces-wwan.xml.in
+++ b/op-mode-definitions/show-interfaces-wwan.xml.in
@@ -80,6 +80,7 @@
                 </properties>
                 <command>echo not implemented</command>
               </leafNode>
+              #include <include/show-interface-type-event-log.xml.i>
             </children>
           </tagNode>
           <node name="wwan">
diff --git a/op-mode-definitions/show-log.xml.in b/op-mode-definitions/show-log.xml.in
index 7ace50cc9..5ee7c973f 100755
--- a/op-mode-definitions/show-log.xml.in
+++ b/op-mode-definitions/show-log.xml.in
@@ -958,6 +958,68 @@
             </properties>
             <command>journalctl --no-hostname --boot --unit squid.service</command>
           </leafNode>
+          <node name="network-event">
+            <properties>
+              <help>Show log for network events</help>
+            </properties>
+            <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service</command>
+            <children>
+              <tagNode name="interface">
+                <properties>
+                  <help>Show log for specific interface</help>
+                  <completionHelp>
+                    <script>${vyos_completion_dir}/list_interfaces</script>
+                  </completionHelp>
+                </properties>
+                <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep $5</command>
+              </tagNode>
+              <node name="route">
+                <properties>
+                  <help>Show log for route events</help>
+                </properties>
+                <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\[$4\]"</command>
+                <children>
+                  #include <include/log/network-event-type-interface.xml.i>
+                </children>
+              </node>
+              <node name="link">
+                <properties>
+                  <help>Show log for network link events</help>
+                </properties>
+                <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\[$4\]"</command>
+                <children>
+                  #include <include/log/network-event-type-interface.xml.i>
+                </children>
+              </node>
+              <node name="addr">
+                <properties>
+                  <help>Show log for network address events</help>
+                </properties>
+                <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\[$4\]"</command>
+                <children>
+                  #include <include/log/network-event-type-interface.xml.i>
+                </children>
+              </node>
+              <node name="neigh">
+                <properties>
+                  <help>Show log for neighbor table events</help>
+                </properties>
+                <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\[$4\]"</command>
+                <children>
+                  #include <include/log/network-event-type-interface.xml.i>
+                </children>
+              </node>
+              <node name="rule">
+                <properties>
+                  <help>Show log for PBR rule change events</help>
+                </properties>
+                <command>journalctl --no-hostname --boot --unit vyos-network-event-logger.service --grep "\[$4\]"</command>
+                <children>
+                  #include <include/log/network-event-type-interface.xml.i>
+                </children>
+              </node>
+            </children>
+          </node>
         </children>
       </node>
     </children>