1. 增加readme.md，指导安装与使用

2. 编译时选择不同的头文件inc

39 files changed, 2130 insertions, 0 deletions

diff --git a/readme.md b/readme.md
new file mode 100644
index 0000000..cece872
--- /dev/null
+++ b/readme.md
@@ -0,0 +1,18 @@
+# 1.���
+frag_monitory����Ƶ��Ƭ���
+
+֧��K��Ŀ��SOQ��Ŀ��
+
+��װʹ����Ҫ�Ķ����ļ�readme.md
+
+# 2.����
+��Ϊav_master��SOQ��K��Ŀ�е�ͷ�ļ���һ�£���˱���˲��������Ҫѡ��inc
+inc_k:��ӦK��Ŀ��av_master��ͷ�ļ�
+inc_soq����Ӧsoq��Ŀ�е�ͷ�ļ�
+����ʱ����Ҫ������Ӧ�������� ��ln -fs inc_k inc�� ���� ��ln -fs inc_soq inc��
+
+# 3.ģ��
+��Ƭ�����ʶ��ģ��frag_monitor.json,��Ҫ������Ŀѡ����ʵ�ģ���ļ���Ĭ��Ϊfrag_monitor_k_online
+frag_monitor_zhongxin_online��SOQ����ϵͳģ��
+frag_monitor_k_online��K��Ŀ����ϵͳģ�壬Ŀǰ��SOQһ��
+frag_monitor_k_online_youtube��K��Ŀ����ʾϵͳģ�壬��Ҫ��Ϊ��֧��youtube
diff --git a/src/inc_k/AV_charater.h b/src/inc_k/AV_charater.h
new file mode 100644
index 0000000..c68a36d
--- /dev/null
+++ b/src/inc_k/AV_charater.h
@@ -0,0 +1,132 @@
+/*
+* Copyright (c) 2008
+* Institute of Computing Technology, Chinese Academy of Sciences.
+* All rights reserved.
+*
+* Authors:		CHEN Xiao-Jun	([email protected])
+*
+* This code can be freely used for academic teaching/learning and research 
+* purposes. Usage for direct or indirect commercial advantage is not
+* allowed without written permission from the authors.
+*
+* Version:	v1.0	November 1, 2008 (CHEN Xiao-Jun)
+*/
+
+
+/*
+* This File include definations of AV Character data and indentify funtion
+* 
+*/
+#ifndef _AV_CHARACTER_H_
+#define _AV_CHARACTER_H_
+
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+
+#define  CONTENTFLAG_UNKNOWN	0
+#define  CONTENTFLAG_TXT		1
+#define  CONTENTFLAG_AV			2
+#define  CONTENTFLAG_DOC		3
+
+// Definatin for all types of vidio and audio file;
+#define FILE_UNKNOWN    0x00
+#define FILE_VIDEO		0x50
+#define	FILE_OGV		0x51
+#define	FILE_WEBM		0x52
+#define	FILE_MOV		0x53
+#define FILE_WMV		0x61		
+#define FILE_MPG		0x62		
+#define FILE_FLV		0x63	
+#define FILE_RMFF		0x65
+#define FILE_AVI		0x66
+#define FILE_SWF		0x67
+#define FILE_MPG4		0x68
+#define FILE_AIFF		0x69
+#define FILE_OGG		0x6A
+#define FILE_DRC		0x6B
+#define FILE_DIRECTSHOW	0x6C
+#define FILE_FLIC		0x6D
+#define FILE_INDEO		0x6E
+#define FILE_MKV		0x6F
+
+#define FILE_AUDIO		0x70
+#define FILE_MP3		0x71
+
+#define  FILE_OSMF   	0xA1
+#define  FILE_HLS   	0xA2
+#define  FILE_IOS   	0xA3
+#define  FILE_ANDRIOD   0xA4
+#define  FILE_APP   	0xA5
+
+#define  AUDIO_UNKNOWN		0xB0
+#define  AUDIO_G711_ULAW	0xB1
+#define  AUDIO_G711_ALAW	0xB2
+#define  AUDIO_G722			0xB3
+#define  AUDIO_G723			0xB4
+#define  AUDIO_G726_40		0xB5
+#define  AUDIO_G726_32		0xB6
+#define  AUDIO_G726_24		0xB7
+#define  AUDIO_G726_16		0xB8
+#define  AUDIO_AAL2_G726_40	0xB9
+#define  AUDIO_AAL2_G726_32	0xBA
+#define  AUDIO_AAL2_G726_24	0xBB
+#define  AUDIO_AAL2_G726_16	0xBC
+#define  AUDIO_G728			0xBD
+#define  AUDIO_G729D		0xBE
+#define  AUDIO_G729E		0xBF
+#define  AUDIO_GSM			0xC0
+#define  AUDIO_GSM_EFR		0xC1
+#define  AUDIO_ILBC			0xC2
+#define  AUDIO_AMR			0xC3
+#define  AUDIO_AMR_WB		0xC4
+#define  AUDIO_SILK			0xC5
+#define  AUDIO_LPC			0xC6
+#define  AUDIO_LPC1016		0xC7
+#define  AUDIO_LPC1015		0xC8
+#define  AUDIO_L16			0xC9
+#define  AUDIO_SPEEX		0xCA
+#define  AUDIO_L8			0xCB
+#define  AUDIO_MPA			0xCC
+#define  AUDIO_DVI4			0xCD
+#define  AUDIO_VDVI			0xCE
+#define  AUDIO_CN			0xCF
+#define  AUDIO_RED			0xD0
+#define  AUDIO_QCELP		0xD1
+#define  AUDIO_EVRC0		0xD2
+#define  AUDIO_EVRCB0		0xD3
+#define  AUDIO_G729         0xD4
+#define	 AUDIO_VIVOX        0xD5
+#define	FILE_DOC			0xF0
+#define	FILE_DOCX			0xF1
+#define	FILE_XLS			0xF2
+#define	FILE_XLSX			0xF3
+#define	FILE_PPT			0xF4
+#define	FILE_PPTX			0xF5
+#define	FILE_PDF			0xF6
+#define	FILE_EXE			0xF7
+#define	FILE_APK			0xF8
+
+#define BE_FRAG_TYPE(t)	 ((t>=FILE_OSMF) && (t<=0xA2))
+#define BE_APP_TYPE(t)	 ((t>=FILE_DOC) && (t<=FILE_APK))
+#define BE_IMAGE_TYPE(t) ((t>=FILE_IMAGE) && (t<0x90))
+#define BE_VIDEO_TYPE(t) ((t>=FILE_VIDEO) && (t<0x70))
+#define BE_AUDIO_TYPE(t) ((t>=FILE_AUDIO) && (t<0x80))
+#define BE_VOIP_TYPE(t) ((t>=AUDIO_UNKNOWN) && (t<=AUDIO_VIVOX))
+
+
+#define FILE_IMAGE		0x80
+
+#define FILE_JPG		0x84
+#define FILE_BMP		0x85
+#define FILE_GIF		0x86
+#define FILE_PNG		0x87
+
+#define MMS_TYPE		0x90
+#define HTTP_STREAM_TYPE  0x90
+#define RTSP_RDT_TYPE	0x92
+#define RTSP_RTP_TYPE	0x91
+
+int AV_IdentifyFormatDoc(const char *sExtName, const char *pHeader, int iHeaderLen,int* mp3flags );
+
+#endif
diff --git a/src/inc_k/AV_entry.h b/src/inc_k/AV_entry.h
new file mode 100644
index 0000000..66360f2
--- /dev/null
+++ b/src/inc_k/AV_entry.h
@@ -0,0 +1,351 @@
+/*
+* Copyright (c) 2014
+* MESA Group,Institute of Information Engineering, Chinese Academy of Sciences.
+* All rights reserved.
+*
+* Authors:		Zheng Chao	([email protected])
+*
+* Version:	v2.0	April 5, 2014 (ZhengChao)
+*/
+
+
+#ifndef _AVENTRY_H_
+#define _AVENTRY_H_
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include "AV_types.h"
+#include <MESA/field_stat2.h>
+#include <MESA/wiredLB.h>
+#include <MESA/rdkafka.h>
+
+#include <stdio.h>
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+#define	MAX_LOCATION_NUM	2
+#define	MAX_PER_LOC_BIZMAN	4
+#define	MAX_AV_DST_TYPE		5
+
+
+struct tdIP
+{
+	unsigned int ip;
+	unsigned int location;//0: backend,1:frontend;
+};
+
+
+typedef struct _FBOption
+{
+	int location_num;
+	int fb_handle_num;
+	char user_tag[128];
+	int wlb_override;
+	char location_type;
+	char uiAvDstFunc[13];
+	unsigned short data_port;
+	int wlb_primary_ip_num[MAX_LOCATION_NUM];
+	int wlb_secondary_ip_num[MAX_LOCATION_NUM];
+	unsigned short wlb_health_port[MAX_LOCATION_NUM];
+	WLB_handle_t wlb_handle[MAX_LOCATION_NUM];
+	char wlb_group[MAX_LOCATION_NUM][256];
+	char wlb_primary_ip[MAX_LOCATION_NUM][512];
+	char wlb_secondary_ip[MAX_LOCATION_NUM][512];
+	struct WLB_consumer_t wlb_cons[MAX_LOCATION_NUM][32];
+}FBOption_t;
+
+#define av_module_name "AV_Module"
+#define voip_module_name "VOIP_Module"
+
+
+
+
+typedef struct _stTVGlobalOption {
+
+	// For AV Data SendBack Setting
+	char     sSendDev[10];			// �ش��豸����
+	unsigned short uiBSendPortNum[MAX_AV_DST_TYPE];		// �ش��˿ڸ��� 
+	unsigned short iBIPMode[MAX_AV_DST_TYPE];		// �ش�ģʽ���� 
+	unsigned int iBSendIPNum[MAX_AV_DST_TYPE];		// �ش���˻�����
+	tdIP        *aiBSendIP[MAX_AV_DST_TYPE];			//�ش� IP �б�
+	unsigned short uiBSendPort[MAX_AV_DST_TYPE];		// �ش��˿�
+	unsigned short DupSendMod;		//���Ʒ���ģʽ��������
+	unsigned short threshold;
+	unsigned short expire_after;
+	unsigned int DupSendMetaSwitch;
+	unsigned int DupFDLogSwitch;
+
+	unsigned int iSendLogModeSwitch;
+	unsigned int iUdpSendLogIPNum;
+	unsigned int iUdpSendLogIP;
+	unsigned short iUdpSendLogPort;
+
+	unsigned short iImageAnalyseIPMode;
+	unsigned int iImageAnalyseIPNum;
+	tdIP		*aiImageAnalyseServer;
+	unsigned short uiImageAnalyseSendPort;
+	unsigned short uiImageAnalyseSendPortNum;
+
+	unsigned short iAppAnalyseIPMode;
+	unsigned int iAppAnalyseIPNum;
+	tdIP		*aiAppAnalyseServer;
+	unsigned short uiAppAnalyseSendPort;
+	unsigned short uiAppAnalyseSendPortNum;
+
+	unsigned int iHdIPNum[MAX_AV_DST_TYPE];		// ��˻�����
+	tdIP        *aiHdIP[MAX_AV_DST_TYPE];		// ��� IP �б�
+	unsigned int iLogHdstat[MAX_AV_DST_TYPE];	//��¼���״̬
+	// For Local server port;
+	unsigned short uiResultReceivePort;	// �������շ�������Ķ˿ں�
+
+	// For Configure and Log Server Setting
+	char sLogServer[128];			// ����Ƶ��־������IP
+	unsigned short iLogPort;		// ����Ƶ��־�������˿�
+
+	unsigned int sLogVoipServer;			// ����ƵVOIP��־������IP
+	unsigned short iLogVoipPort;		// ����ƵVOIP��־�������˿�
+
+	char table_info_path[256];
+	char inc_cfg_dir[256];
+	char full_cfg_dir[256];
+	char backup_cfg_dir[256];
+	
+	char voip_table_info_path[256];
+	char voip_inc_cfg_dir[256];
+	char voip_full_cfg_dir[256];
+
+	char global_dynamic_rule_table_info_path[256];
+	char local_dynamic_rule_table_info_path[256];
+	char global_dynamic_rule_redis_ip[256];
+	char local_dynamic_rule_redis_ip[256];	
+	unsigned short global_dynamic_rule_redis_port_num;
+	unsigned short global_dynamic_rule_redis_port;
+	unsigned short local_dynamic_rule_redis_port;
+	unsigned short dynlist_listen_port;
+
+	// For Hash List size
+	unsigned int uiDynamicBWSize;		// ��̬����/������������С
+	unsigned int uiDynamicB_ExpireTime;	// ��̬��������ʧЧʱ��
+	unsigned int uiDynamicW_ExpireTime;	// ��̬����������ʧЧʱ��
+	unsigned int uiTVListSize;			// ��Ŀ��������С			
+
+	// Switch for debug Setting
+	unsigned short iLog_SendBack_Data;	// �ش�������־��¼����
+	unsigned short iLog_Found_Prog;		// ���ֵĽ�ĿURL��־��¼����
+	unsigned short iLog_Fendu_Msg_Act;	// FD��Ϣ�Ͷ�����־��¼����
+	unsigned short iLog_Config;			// ���ý��ܹ�����־��¼����
+	unsigned short uiSw_Store_Stream;	// �����ݴ洢��־��¼����
+	unsigned short  iSendMetaLog;			// ��¼���ͽ�ĿԪ��Ϣ��ͷ���Ŀ���
+	
+
+
+	unsigned int uiLogMsgLocal;			// �����Ƿ�洢��ǰ�˻�����
+	unsigned int uiLogFileSize;			// �洢�ļ�����
+	unsigned int uiNetlogSwitch;		//asmis log switch
+
+	unsigned short  iLog_Found_BtProg;	// ʶ���bt��Ŀ
+	unsigned short  iLog_Found_BtInfo;	// bt��Ϣ
+	unsigned short iStaticsLog;			// ͳ����־���ؼ�¼����
+	unsigned short iStaticsLogZip;			// ͳ����־�Ƿ����ѹ������
+
+	unsigned int uiJsonRuleSwitch;
+	unsigned int uiFengDu;			
+	unsigned int uiConnBlklistSwitch;				// do 3 tuple black list switch
+	unsigned int uiMinImageSize;
+	unsigned int uiMaxImageSize;
+	//add by lqy 20110329
+	unsigned int uiLenLimited;
+	unsigned int uiMinAvSize;
+	unsigned int uiMaxAvSize;
+
+	unsigned int uiClientIP;				//
+	unsigned int uiLocalIP;					// localip;
+	unsigned int uiDoSendData;				// wheather send data ?
+	unsigned int uiRawSendData;			//raw Send Data Switch
+	unsigned int uiPagSendData;			//pag Send Data Switch
+	unsigned int uiLoopSendData;			// loop Send Data Switch
+	unsigned int uiLockSwitch;				// lock  Switch
+	unsigned int uiAckSendData;			//ack av data switch
+	unsigned int uiAVDataMaxLen;
+	unsigned int uiAckListenPort;			// ack listern port
+    unsigned int uiAckQueueSize;        // ack retransmit queue
+    unsigned int uiAckTimeout;          // ack time-out
+ 	unsigned int uiAckThreshold;        // bytes that required ack in the front of a program 
+	unsigned int uiTvQueueSize;        //tv datasize
+	unsigned int uiBizmanMaxResendTimes;//5 times as default
+	unsigned int uiBizmanResendTimeBaseMiliSeconds;//500ms as default
+	unsigned int uiBizmanStreamFrozenMiliSeconds;//30000ms as default
+	unsigned int uiBizmanSendSmoothMiliSeconds;
+	unsigned int uiBizmanCacheSmoothPktsLimit;
+	unsigned int local_dynhash_timeout;
+	unsigned int BlockWhitehashTimeout; 
+	unsigned int log_accumulate_timeout;
+	unsigned int log_max_accumulate_cnt;
+	unsigned int voip_switch;
+	unsigned int prog_trans_kafka_switch;
+	unsigned int fd_type2_kafka_switch;
+	unsigned int redis_switch;
+	char log_acc_service_type[1024];
+	unsigned int stat_cycle;
+	unsigned int screen_print_switch;
+
+	FBOption_t fbOption[MAX_AV_DST_TYPE];
+
+	unsigned int local_ip_nr; 
+	unsigned int log_local_msg;
+	unsigned int ip2region_switch;
+	char local_ip_str[128];
+	char log_local_msg_path[128];
+	char prog_trans_kafka_brokers[1024];
+	char fd_type2_kafka_brokers[1024];	
+	char fs2_ip[32];
+	unsigned short fs2_port;
+}tdAVOption;
+#define	AV_STAT_FIELD_MAX_NUM		63
+#define	AV_STAT_FIELD_PROG_CNT		0
+#define	AV_STAT_FIELD_SND_BYTS		1
+#define	AV_STAT_FIELD_SND_PKTS		2
+#define	AV_STAT_FIELD_SND_ERR		3
+#define	AV_STAT_FIELD_RESORT_BYTS	4
+#define	AV_STAT_FIELD_RESORT_PKTS	5
+#define	AV_STAT_FIELD_SURVEY_CNT	6
+#define	AV_STAT_FIELD_DEDUP_BYTS	7
+#define	AV_STAT_FIELD_DEDUP_PKTS	8
+#define	AV_STAT_FIELD_PRE_ACK		9
+#define	AV_STAT_FIELD_LOG_CNT		10
+#define	AV_STAT_FIELD_IMAGE_BYTS	11
+#define	AV_STAT_FIELD_IMAGE_PKTS	12
+#define	AV_STAT_FIELD_IMAGE_CNT		13
+#define	AV_STAT_FIELD_ADD_ACC		14
+#define	AV_STAT_FIELD_DEL_ACC		15
+#define	AV_STAT_FIELD_ADD_TRANSF	16
+#define	AV_STAT_FIELD_DEL_TRANSF	17
+#define	AV_STAT_FIELD_READ_TRANSF	18
+#define	AV_STAT_FIELD_APP_BYTS		19
+#define	AV_STAT_FIELD_APP_PKTS		20
+#define	AV_STAT_FIELD_APP_CNT		21
+#define	AV_STAT_FIELD_FRAG_BYTS		22
+#define	AV_STAT_FIELD_FRAG_PKTS		23
+#define	AV_STAT_FIELD_FRAG_CNT		24
+#define	AV_STAT_FIELD_KFA_SEND_NUM	25
+#define	AV_STAT_FIELD_KFA_SEND_BYTS	26
+#define	AV_STAT_FIELD_KFA_DROP_NUM	27
+#define	AV_STAT_FIELD_KFA_DROP_BYTS	28
+#define	AV_STAT_FIELD_VOIP_BYTS		29
+#define	AV_STAT_FIELD_VOIP_PKTS		30
+#define	AV_STAT_FIELD_VOIP_CNT		31
+#define	AV_STAT_FIELD_KFA_FD2_NUM	32
+#define	AV_STAT_FIELD_KFA_FD2_BYTS	33
+#define	AV_STAT_FIELD_KFA_DROP_FD2_NUM	34
+#define	AV_STAT_FIELD_KFA_DROP_FD2_BYTS	35
+#define	AV_STAT_FIELD_SAPP_BYTES	36
+#define	AV_STAT_FIELD_SAPP_PKTS		37
+#define	AV_STAT_FIELD_HIT_DYN_IP	38
+#define	AV_STAT_FIELD_SIP_SIG_NUM	39
+#define AV_STAT_FIELD_VOIP_LOG_CNT	40
+#define AV_STAT_FIELD_SEV17_LOG		41
+#define AV_STAT_FIELD_SEV35_LOG		42
+#define AV_STAT_FIELD_SEV17_SURVEY	43
+#define AV_STAT_FIELD_SEV35_SURVEY	44
+#define	AV_STAT_FIELD_RTP_CODING_KNOWN_NUM  45
+#define	AV_STAT_FIELD_RTP_CODING_KNOWN_BYTS  46
+#define	AV_STAT_FIELD_IDENTIFY_AV_DUP_PROG  47
+#define	AV_STAT_FIELD_IDENTIFY_AV_DUP_PKTS  48
+#define	AV_STAT_FIELD_IDENTIFY_AV_DUP_BYTS  49
+#define	AV_STAT_FIELD_HUD_S  		50
+#define	AV_STAT_FIELD_HUD_D  		51
+#define	AV_STAT_FIELD_CM_CNT  		52
+#define	AV_STAT_FIELD_FRAG_IDX_CNT 		53
+#define	AV_STAT_FIELD_CM_302_CNT  		54
+#define	AV_STAT_FIELD_CM_GUMBO_IN_CNT  	55
+#define	AV_STAT_FIELD_CM_GUMBO_OUT_CNT  56
+#define	AV_STAT_FIELD_CM_URL_CNT  		57
+#define	AV_STAT_FIELD_ALL_LOG_REFER		58
+#define	AV_STAT_FIELD_FD2_LOG_REFER		59
+#define	AV_STAT_FIELD_DROP_PKTS			60
+#define	AV_STAT_FIELD_DROP_BYTES		61
+#define	AV_STAT_FIELD_LOCATION_ERR		62
+
+
+
+
+typedef struct
+{
+	unsigned long long id;
+	const char *str;
+}fs2_str_contrast_id_t;
+
+
+typedef struct _av_stat_t
+{
+	unsigned long proto_bytes[AV_PROTOCOL_MAX_NUM];
+	unsigned long proto_pkts[AV_PROTOCOL_MAX_NUM];
+	unsigned long prog_cnt;
+	unsigned long bytes;
+	unsigned long pkts;
+	unsigned long send_err;
+	unsigned long resort_bytes;
+	unsigned long resort_pkts;
+	unsigned long image_bytes;
+	unsigned long image_pkts;
+	unsigned long image_cnt;
+	unsigned long survey_cnt;
+	unsigned long	avsendpkt;
+	unsigned long	av_dedup_bytes;
+	unsigned long	av_dedup_pkt;
+	unsigned long	avpreacknum;
+	unsigned long log_cnt;
+	unsigned long add_transf;
+	unsigned long del_transf;
+	unsigned long read_transf;
+	unsigned long add_acc;
+	unsigned long del_acc;
+	unsigned long app_bytes;
+	unsigned long app_pkts;
+	unsigned long app_cnt;
+	unsigned long frag_bytes;
+	unsigned long frag_pkts;
+	unsigned long frag_cnt;
+	unsigned long voip_bytes;
+	unsigned long voip_pkts;
+	unsigned long voip_cnt;
+	int fs_id[AV_STAT_FIELD_MAX_NUM];
+}AV_stat_t;
+
+extern tdAVOption g_AVOption;
+extern AV_stat_t g_AVStat;
+extern int g_iAVSwitch;
+extern void *g_av_logger;
+extern void *g_img_fp_scanner;
+extern unsigned int g_AV_CurrentTime;
+extern unsigned int g_thread_num;
+extern rd_kafka_t *g_multi_kafka_producer;
+extern screen_stat_handle_t g_av_stat_handle;
+extern screen_stat_handle_t g_AV_scan_feather;
+extern screen_stat_handle_t g_VOIP_scan_feather;
+extern screen_stat_handle_t g_AV_global_feather;
+
+#ifdef	NTC_SWITCH
+extern int AV_MASTER_NTC_CHECK;
+#endif
+
+
+void net_log_ysp_info(int interval,unsigned long long *inputinfo,unsigned long long *outputinfo);
+int avchecklogip(const struct layer_addr* paddr);
+
+extern FILE * g_BlockMsgfd;
+extern FILE * g_BlockActionfd;
+extern FILE * g_SndBackfd[MAX_THREAD_NUM];
+extern FILE * g_fp_logprog;
+extern FILE * g_rtspfd;
+extern FILE * g_Configfd;
+extern FILE * g_Staticsfd;
+extern FILE * g_SendMetafd;
+extern FILE * g_DropRate;
+
+void WriteLocalLog(FILE * fp,const char *fmt,...);
+#ifdef	__cplusplus
+}
+#endif
+#endif
diff --git a/src/inc_k/AV_feedback.h b/src/inc_k/AV_feedback.h
new file mode 100644
index 0000000..dbf040a
--- /dev/null
+++ b/src/inc_k/AV_feedback.h
@@ -0,0 +1,98 @@
+#ifndef _AVPROG_FEEDBACK_H_
+#define _AVPROG_FEEDBACK_H_
+
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+
+#include "AV_types.h"
+
+#define	SOFT_LOAD_FXQD	0x00
+#define	SOFT_LOAD_FXHD	0x01
+
+
+#define META_FLAG_DUMP_ORIGION 		0x01		//��¼��Ŀԭʼ�ļ�
+#define META_FLAG_DUMP_DECODED 		0x02		//��¼��Ŀ�������ļ�
+#define META_FLAG_DUMP_SEND_MSG		0x04		//���ͼ�⽨��
+
+
+// Data_flag defination
+
+//meta info's option type
+#define	META_OPT_TYPE_HTTP_CNT	0x51
+#define	META_OPT_LAYER_ADDR		0x52	//opt value is const struct layer_addr* addr
+#define	META_OPT_TYPE_URL		0x61
+#define META_OPT_ETAG 			0x62
+#define META_OPT_LAST_MODIFY 	0x63
+#define META_OPT_REFERER 		0x64   
+#define META_OPT_USER_AGENT 	0x65 
+#define META_OPT_C2S_CONT_TYPE	0x66  
+#define META_OPT_S2C_CONT_TYPE 	0x67
+#define META_OPT_SINGLE_KEY 	0x68
+#define	META_OPT_OPEN_OFFSET	0x69
+#define	META_OPT_SERVER		0x6A
+#define	META_OPT_CONT_TYPE	0x6B
+
+
+ 
+#define META_OPT_SERVICE_ID 	0x71  /*��Ƭ��ʹ��*/
+#define META_OPT_C2S_CONT 		0x72  
+#define META_OPT_S2C_CONT 		0x73
+#define META_OPT_CONT_DISPOSITION 0x74 
+
+#define META_OPT_SIP_DIADATA_ID	0x81 
+#define META_OPT_SIP_DATA_DIR	0x82
+#define META_OPT_SIP_RATE_INFO	0x83
+
+
+typedef struct _dropRdate
+{
+	unsigned long long meta_num;
+	unsigned long long meta_resend_num;
+	float meta_resend_rate;
+	unsigned long long meta_active_prog;
+	unsigned long long pkt_num;
+	unsigned long long pkt_resend_num;
+	float pkt_resend_rate;
+	unsigned long long pkt_ack;
+	unsigned long long pkt_preack;
+	unsigned long long drop_pkts;
+	float drop_rate;
+	unsigned long long drop_mem;
+	unsigned long long forzened;
+	unsigned long long avsend;
+	unsigned long long av_dup;
+}dropRdate_t;
+
+
+struct media_info_t
+{
+	PROG_ID_t pid;
+	UINT64 prog_len;
+	UCHAR pad[1];
+	UCHAR protocol;		//define at AV_types.h's AV_PROTOCOL_**
+	UCHAR media_type;	//define	at AV_character.h
+	UCHAR check_flag;	//set META_FLAG_DUMP flag if monitor hit
+	INT service;		//directly use struct AV_rule_t 's service
+};
+//Set service if service action is AV_ACTION_MONIT
+int AV_send_media_info(const struct media_info_t* media_info,const struct opt_unit_t* opt,int opt_num,int thread_seq);
+int AV_send_data(PROG_ID_t pid,unsigned long long offset, const char * data, unsigned int datalen,
+					UCHAR protocol ,int thread_seq,const struct layer_addr* addr);
+
+#define	AV_DST_NORMAL			0
+#define	AV_DST_IMAGE_ANALYZER	1
+#define	AV_DST_FRAGMENT_QUERY	2
+#define	AV_DST_APP				3
+#define	AV_DST_VOIP				4
+
+//AV_send_media_info_to specify the destination type by parameter DST,which is defined like AV_DST_**
+int AV_send_media_info_to(char DST,const struct media_info_t* media_info,const struct opt_unit_t* opt,int opt_num,int thread_seq);
+int AV_send_data_to(char DST,PROG_ID_t pid,unsigned long long offset, const char * data, unsigned int datalen,
+							UCHAR protocol ,int thread_seq, const struct layer_addr* addr);
+
+
+int  SendLiveCheckMsg();//ONLY used by AV master controller
+
+#endif
+
diff --git a/src/inc/AV_kill_connection.h b/src/inc_k/AV_kill_connection.h
index 9487548..9487548 100644
--- a/src/inc/AV_kill_connection.h
+++ b/src/inc_k/AV_kill_connection.h
diff --git a/src/inc_k/AV_log.h b/src/inc_k/AV_log.h
new file mode 100644
index 0000000..345994a
--- /dev/null
+++ b/src/inc_k/AV_log.h
@@ -0,0 +1,130 @@
+#ifndef _AV_LOG_H_
+#define _AV_LOG_H_
+
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include <MESA/stream.h>
+#include <MESA/field_stat.h>
+#include "AV_types.h"
+#include "AV_rule.h"
+
+
+// FD����, 0��ʾ��̬�ڰ�������1��ʾ��̬�������У�2��ʾ���������ڵ����С�
+#define	FD_TYPE_DYNAMIC_LIST	0
+#define	FD_TYPE_STATIC_CONF		1
+#define	FD_TYPE_ANALYSE			2
+
+
+#define	OPT_ACC_CNT			0x01
+#define	OPT_SERVICE			0x02
+#define	OPT_MEDIA_TYPE		0x03
+#define	OPT_CHECK_FLAG		0x04
+#define	OPT_DROP_RATE		0x05
+#define	OPT_ID				0x06
+#define	OPT_IDC				0x07
+#define	OPT_LOG_MSG			0x08
+#define	OPT_SINGLE_KEY		0x09
+
+
+#define	AV_LOG_OPT_IMG_FP			0x10
+#define	AV_LOG_OPT_FRAG_ORIGION_URL	0x11
+#define	AV_LOG_OPT_FRAG_SUBSTR		0x12
+#define	AV_LOG_OPT_FRAG_INDEX_URL	0x13
+#define	AV_LOG_OPT_IMG_LENGTH		0x14
+#define	AV_LOG_OPT_IMG_FP_STR		0x15
+
+#define	AV_LOG_OPT_HTTP_COOKIE		0x19
+#define	AV_LOG_OPT_LOG_URI			0x20	/* == OPT_FRAG_URL */
+#define	AV_LOG_OPT_PROTO_URL		0x21	/* == OPT_PROG_URL */
+#define	AV_LOG_OPT_PROTO_REFERER	0x22
+#define	AV_LOG_OPT_HTTP_SESSION_SEQ	0x23
+#define	AV_LOG_OPT_HTTP_UA			0x24
+#define	AV_LOG_OPT_HTTP_PROXY_FLAG	0x25
+#define	AV_LOG_OPT_TCP_CLIENT_SEQ	0x26
+#define	AV_LOG_OPT_HTTP_PROXY_DOMAIN	0x27
+#define	AV_LOG_OPT_HTTP_DOMAIN			0x28
+#define	AV_DST_TYPE		0x29
+
+#define	OPT_FRAG_URL				0x20
+#define	OPT_PROG_URL				0x21
+#define	OPT_USERNAME				0x2A
+#define	OPT_PASSWORD				0x2B
+#define	OPT_LOG_REFER				0x2C
+#define	OPT_LAYER_ADDR_V4			0x2D
+#define	OPT_LAYER_ADDR_V6			0x2E
+#define	OPT_VOIP_RECV_TIME			0x2F
+#define	OPT_VOIP_DUATION			0x30
+#define	OPT_VOIP_PROTCOL			0x31
+#define	OPT_VOIP_CALLING_ACCOUNT	0x32
+#define	OPT_VOIP_CALLED_ACCOUNT		0x33
+#define	OPT_VOIP_CALLING_NUMBER		0x34
+#define	OPT_VOIP_CALLED_NUMBER		0x35
+#define	OPT_VOIP_FROM_TO_STORE_IP	0x36
+#define	OPT_VOIP_FROM_TO_STORE_URL	0x37
+#define	OPT_VOIP_TO_FROM_STORE_IP	0x38
+#define	OPT_VOIP_TO_FROM_STORE_URL	0x39
+
+#define	AV_LOG_OPT_VXLAN_INFO		0x40
+
+
+typedef struct _av_log_t
+{
+	PROG_ID_t pid;
+	unsigned char fd_type;	//define at this file FD_TYPE_**
+	unsigned char protocol;	//define at AV_types.h's AV_PROTOCOL_**
+	struct streaminfo *a_stream;
+	AV_rule_t* cfg;
+	
+}AV_log_t;
+//return 0 if SUCCESS, otherwise return -1
+int AV_init_log(const char* server_ip,unsigned short port, unsigned int sendlog_mode);//ONLY used by AV Master Controller 
+int AV_send_log(const AV_log_t* log_msg,struct opt_unit_t* log_opt,int opt_num);
+int AV_send_log_to(const AV_log_t* log_msg,struct opt_unit_t* opt,int opt_num, int av_type);
+
+//INPUT:
+//	protocol define as AV_types.h 's AV_PROTOCOL_XXX
+//	url could be "null" if not accquired,MUST end with '\0'
+typedef struct _av_info_t
+{
+	const struct streaminfo* a_stream;
+	PROG_ID_t pid;
+	const char* url;
+	unsigned long long length;
+	unsigned char protocol;
+}AV_info_t;
+
+void AV_log_prog_local(const AV_info_t* p);
+
+
+#define	LOCAL_LOG_TYPE_FRAG_FIND_PROG	0
+#define	LOCAL_LOG_TYPE_FENGDU_ACTION	1
+#define	LOCAL_LOG_TYPE_FENGDU_MSG		2
+#define	LOCAL_LOG_TYPE_MEDIA_INFO		3
+#define	LOCAL_LOG_TYPE_DROP_RATE		4
+#define	LOCAL_LOG_TYPE_FD_TYPE2			5
+#define	LOCAL_LOG_TYPE_VOIP_ACTION		6
+#define	LOCAL_LOG_TYPE_AV_FIND_PROG		7
+#define	LOCAL_LOG_TYPE_FRAG_SERVER_IP	8
+#define	LOCAL_LOG_TYPE_MM_AV_IP_LOG		9
+#define	LOCAL_LOG_TYPE_MM_AV_URL_LOG			10
+#define	LOCAL_LOG_TYPE_MM_PIC_IP_LOG			11
+#define	LOCAL_LOG_TYPE_MM_PIC_URL_LOG			12
+#define	LOCAL_LOG_TYPE_MM_VOIP_IP_LOG			13
+#define	LOCAL_LOG_TYPE_MM_VOIP_ACCOUNT_LOG		14
+#define	LOCAL_LOG_TYPE_MM_SAMPLE_AUDIO_LOG		15
+#define	LOCAL_LOG_TYPE_MM_SAMPLE_VIDEO_LOG		16
+#define	LOCAL_LOG_TYPE_MM_PORN_AUDIO_LEVEL_LOG	17
+#define	LOCAL_LOG_TYPE_MM_PORN_VIDEO_LEVEL_LOG	18
+#define	LOCAL_LOG_TYPE_MM_SAMPLE_PIC_LOG		19
+#define	LOCAL_LOG_TYPE_MM_SAMPLE_VOIP_LOG		20
+#define	LOCAL_LOG_TYPE_MM_FILE_DIGEST_LOG		21
+#define	LOCAL_LOG_TYPE_MM_SPEAKER_RECOGNIZATION_LOG	22
+#define	LOCAL_LOG_TYPE_MM_LOGO_DETECTION_LOG		23
+#define	LOCAL_LOG_TYPE_MM_FACE_RECOGNIZATION_LOG	24
+
+int AV_kafka_init(int thread_num);
+void AV_local_log_convert_json(const AV_info_t* p, int local_log_type, opt_unit_t *opt, int opt_num);
+
+#endif
+
diff --git a/src/inc/AV_plugin_log.h b/src/inc_k/AV_plugin_log.h
index 59201de..59201de 100644
--- a/src/inc/AV_plugin_log.h
+++ b/src/inc_k/AV_plugin_log.h
diff --git a/src/inc_k/AV_prog_table.h b/src/inc_k/AV_prog_table.h
new file mode 100644
index 0000000..9e1e692
--- /dev/null
+++ b/src/inc_k/AV_prog_table.h
@@ -0,0 +1,96 @@
+#ifndef _AV_PROG_MANAGER_H_
+#define _AV_PROG_MANAGER_H_
+
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+
+#include "AV_types.h"
+
+typedef	struct _av_blk_info_t
+{
+	volatile UCHAR actflg;//define as AV_rule.h's AV_ACTION_**
+}AV_INSTANT_BLKINF_t;
+#define	MAX_AVPROG_LEN					0xffffff	//48bit
+
+#define	PID_TYPE_DEF 		0
+#define	PID_TYPE_URL 		1
+#define	PID_TYPE_IPLEN	 	2
+#define	PID_TYPE_CON 		3
+#define	PID_TYPE_ADDR		4
+#define	PID_TYPE_COUNT  	5 
+#define	PID_TYPE_RESORT		6
+#define	PID_TYPE_IMAGE		7
+
+
+#define	AVPROG_INFO_HIT_RULE		0x01	//AV_rule_t
+#define	AVPROG_INFO_FILE_TYPE		0x02	//UCHAR
+#define	AVPROG_INFO_LOG_URI			0x03	//STR
+#define	AVPROG_INFO_BLK_FLAG		0x04	//AV_INSTANT_BLKINF_t
+#define	AVPROG_INFO_OFFSET			0x05	//UINT64
+#define AVPROG_INFO_TRANSMISSION    0x06	//AV_TRANS_INFO_t
+#define AVPROG_INFO_HIT_POS			0x07	//UCHAR FD_TYPE_** in AV_log.h
+#define	AVPROG_INFO_APPPKG_PARA		0x08	//void*,must write with AV_write_prog_cb
+#define	AVPROG_INFO_DYN_SUBSTR		0x09	//STR
+#define	AVPROG_INFO_SEND_PKTS		0x10	//UINT64
+#define	AVPROG_INFO_SEND_BYTES		0x11	//UINT64
+
+#define	MAX_AVPROG_INFO_TRANSMISSION	16
+
+#define	OPT_FRAG_ORIGION_URL	0x11
+#define	OPT_FRAG_CTRL_SUBSTR	0x12
+#define	OPT_FRAG_INDEX_URL		0X13
+#define	OPT_IMAGE_LENGTH		0X14
+
+
+typedef struct _av_trasmission_info_t
+{	
+	int http_seq;
+	unsigned int isn;
+	struct layer_addr *addr;
+	char* url;
+	char* refer;
+	char *domain;
+#ifdef	NTC_SWITCH
+	struct vxlan_info vinfo; 
+#endif
+}AV_TRANS_INFO_t;
+
+
+const AV_INSTANT_BLKINF_t* AV_add_prog(PROG_ID_t pid);
+void AV_del_prog(PROG_ID_t pid);
+//return 1 on SUCCESS,otherwise return 0;
+long AV_read_prog(PROG_ID_t pid,int type,void* value,unsigned int* size);
+//return 1 on SUCCESS,otherwise return 0;
+long AV_write_prog(PROG_ID_t pid,int type,void* value,unsigned int size);
+//should NOT called by business plugin
+int AV_refresh_prog_table(void);
+
+typedef void member_free_cb_t(void *member,void *arg);
+
+//return 1 on SUCCESS;
+//return -1 on type already exist;
+//return 0 on pid not exist or invalid parameters ;
+long AV_write_prog_cb(PROG_ID_t pid,int type,void*value,unsigned int size,member_free_cb_t* free_cb,void* arg);
+
+PROG_ID_t AV_make_porg_id(unsigned char * key, unsigned int size, unsigned char type);
+
+ //return 1 if success,otherwise return 0, which means need more key input;
+ //pid 			[OUTPUT]
+ //acc_len		[INPUT/OUTPUT],MUST init to 0 at first call
+ //total_acc_size	[INPUT] total accumulation size
+ //key			[INPUT] string used to make pid
+ //size			[INPUT] string's size
+int  AV_acc_make_porg_id(PROG_ID_t *pid, unsigned int* acc_len, unsigned int total_acc_size, unsigned char* key, unsigned int size);
+
+
+int AV_init_prog_table(unsigned int TVHashSize,unsigned int DBlackHashSize);//used by master controller;
+int AV_start_survey_recv_thread(void);
+int AV_check_pid_type(unsigned long long pid,unsigned char type);
+
+//return 0 if success,otherwise return -1;
+int append_http_query_key(struct streaminfo *a_tcp,int http_seq, char *out_buff, int buff_len);
+
+
+#endif
+
diff --git a/src/inc_k/AV_rule.h b/src/inc_k/AV_rule.h
new file mode 100644
index 0000000..706bf5d
--- /dev/null
+++ b/src/inc_k/AV_rule.h
@@ -0,0 +1,117 @@
+#ifndef	_AV_RULE_SCAN_H_
+#define	_AV_RULE_SCAN_H_
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include <MESA/stream.h>
+#include <MESA/Maat_rule.h>
+#include "AV_types.h"
+
+#define	AV_RULE_LOAD_TYPE	5
+#define	AV_RULE_REGION_TYPE	6
+
+#ifdef	NTC_SWITCH
+typedef struct _av_rule_t
+{
+	char level;
+	int	service;
+	int	cfg_id;
+}AV_rule_t;
+#else
+typedef struct _av_rule_t
+{
+	unsigned char	service;
+	unsigned char	level;
+	unsigned int	cfg_id;
+}AV_rule_t;
+
+#endif
+
+typedef struct _av_feature_info_t
+{
+	UINT64 mid;
+	AV_rule_t av_rule;
+	short opt_num;
+}AV_feature_info_t;
+
+//initial function ,called by av master
+int AV_rule_init(const char* table_info_path,const char* full_cfg_dir,const char* inc_cfg_dir,void* logger);
+int AV_dynamic_rule_init(const char* table_info_path, char* redis_ip, unsigned short redis_port,void* logger);
+
+//If hit any config return region_id ,otherwise return -1;
+int get_region_id(unsigned int host_ip, int thread_num);
+
+//initial function ,called by av master
+int VOIP_rule_init(const char* table_info_path,const char* full_cfg_dir,const char* inc_cfg_dir,void* logger);
+
+
+//If hit any config return 1 ,otherwise return 0;
+int AV_rule_scan_addr(const struct layer_addr* addr,AV_rule_t*result,int thread_num);
+//If hit any config return 1 ,otherwise return 0;
+int AV_rule_scan_url(const char* url,int len,AV_rule_t*result,int thread_num);
+int AV_rule_scan_frag_url(const char* url, int len, Maat_rule_t *result, int result_num, unsigned char *fd_type, int thread_num);
+int AV_rule_scan_img_url(const char* url, int len, AV_rule_t*result,char* log_uri,int *uri_len, unsigned char *fd_type, int thread_num);
+
+
+//If hit any config return 1 ,otherwise return 0;
+int AV_rule_scan_numerical(int numerical, int av_rule_type, AV_rule_t*result, scan_status_t *mid, int thread_num);
+
+#define	AV_ACTION_UNKNOWN	0x00 //caused by invalid service;
+#define	AV_ACTION_MONIT		0x01
+#define	AV_ACTION_BLOCK		0x02
+#define	AV_ACTION_WHITE		0x04
+
+#ifdef	NTC_SWITCH
+unsigned char AV_rule_action(int service);
+#else
+unsigned char AV_rule_action(unsigned char service);
+#endif
+
+stream_para_t AV_rule_scan_image_start(int thread_num);
+int AV_rule_scan_image(stream_para_t* p_stream_para,const char* image_stream,int len,AV_rule_t*result,char* log_uri,int *uri_len);
+void AV_rule_scan_image_end(stream_para_t* p_stream_para);
+
+int is_av_dynamic_blacklist(struct streaminfo *a_tcp);
+
+
+typedef struct _image_info_t
+{
+	const struct layer_addr* addr;
+	const char* url;
+	UINT64 size;
+	int format;//defined in AV_character.h FILE_**
+}IMG_info_t;
+//return 1 if need feedback;
+int AV_rule_image_feedback_pending(IMG_info_t* img_info, int thread_num);
+
+//make local dynamic blacklist by source ip address,dest ip address , dest ip port and content size
+void AV_make_conn_blacklist(struct streaminfo* a_stream,UINT64 cont_size);
+//return 1 if hit blacklist,otherwise return 0;
+int AV_check_conn_blacklist(struct streaminfo* a_stream,UINT64 cont_size);
+
+void AV_free_feature_info(void *data);
+//substr is key
+void AV_make_conn_feature(const UCHAR *substr, UINT32 substr_len, void *feature_info, UINT32 feature_info_len);
+//return 1 if hit blacklist,otherwise return 0;
+int AV_check_conn_feature(const UCHAR *substr, UINT32 substr_len, void **feature_info, UINT32 *feature_info_len);
+
+/*
+����ֵ:
+	>0: ע��ɹ�������һ����Ч��table_id
+	-1: ע��ʧ��
+*/
+int AV_plugin_register_table_id(const char* table_name);
+
+/*
+����ֵ��
+	1: �������ã����н��������result��
+	0:	�������
+	-2: ��ǰ�����������У���δ��������������У� result�����κ��޸ģ�
+	-1: ɨ��������Ϸ���table_id���Ϸ�����Ӧ�ı����Ͳ���ȷ
+*/
+int AV_plugin_rule_scan_addr(int table_id, const struct layer_addr *addr, AV_rule_t *result, int thread_num);
+int AV_plugin_rule_scan_url(int table_id, const char *url,int len, AV_rule_t *result, int thread_num);
+
+
+#endif
+
diff --git a/src/inc/AV_types.h b/src/inc_k/AV_types.h
index 4522fcd..4522fcd 100644
--- a/src/inc/AV_types.h
+++ b/src/inc_k/AV_types.h
diff --git a/src/inc/MESA_trace.h b/src/inc_k/MESA_trace.h
index b2fce85..b2fce85 100644
--- a/src/inc/MESA_trace.h
+++ b/src/inc_k/MESA_trace.h
diff --git a/src/inc/Maat_command.h b/src/inc_k/Maat_command.h
index 5d2b6b9..5d2b6b9 100644
--- a/src/inc/Maat_command.h
+++ b/src/inc_k/Maat_command.h
diff --git a/src/inc/Maat_rule.h b/src/inc_k/Maat_rule.h
index e160a4a..e160a4a 100644
--- a/src/inc/Maat_rule.h
+++ b/src/inc_k/Maat_rule.h
diff --git a/src/inc/field_stat2.h b/src/inc_k/field_stat2.h
index 2c64780..2c64780 100644
--- a/src/inc/field_stat2.h
+++ b/src/inc_k/field_stat2.h
diff --git a/src/inc/http.h b/src/inc_k/http.h
index 4e113d9..4e113d9 100644
--- a/src/inc/http.h
+++ b/src/inc_k/http.h
diff --git a/src/inc/opt.h b/src/inc_k/opt.h
index 028972d..028972d 100644
--- a/src/inc/opt.h
+++ b/src/inc_k/opt.h
diff --git a/src/inc/opt_in.h b/src/inc_k/opt_in.h
index de45b13..de45b13 100644
--- a/src/inc/opt_in.h
+++ b/src/inc_k/opt_in.h
diff --git a/src/inc/optregister.h b/src/inc_k/optregister.h
index ae42001..ae42001 100644
--- a/src/inc/optregister.h
+++ b/src/inc_k/optregister.h
diff --git a/src/inc/wired_cfg.h b/src/inc_k/wired_cfg.h
index 6c4a1c3..6c4a1c3 100644
--- a/src/inc/wired_cfg.h
+++ b/src/inc_k/wired_cfg.h
diff --git a/src/inc/zd_statistics_log.h b/src/inc_k/zd_statistics_log.h
index baaa02f..baaa02f 100644
--- a/src/inc/zd_statistics_log.h
+++ b/src/inc_k/zd_statistics_log.h
diff --git a/src/inc/AV_charater.h b/src/inc_soq/AV_charater.h
index 3990520..3990520 100644
--- a/src/inc/AV_charater.h
+++ b/src/inc_soq/AV_charater.h
diff --git a/src/inc/AV_entry.h b/src/inc_soq/AV_entry.h
index 66f524a..66f524a 100644
--- a/src/inc/AV_entry.h
+++ b/src/inc_soq/AV_entry.h
diff --git a/src/inc/AV_feedback.h b/src/inc_soq/AV_feedback.h
index 1433116..1433116 100644
--- a/src/inc/AV_feedback.h
+++ b/src/inc_soq/AV_feedback.h
diff --git a/src/inc_soq/AV_kill_connection.h b/src/inc_soq/AV_kill_connection.h
new file mode 100644
index 0000000..9487548
--- /dev/null
+++ b/src/inc_soq/AV_kill_connection.h
@@ -0,0 +1,71 @@
+#ifndef _AV_KILL_CONNECTION_H_
+#define	_AV_KILL_CONNECTION_H_
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include "AV_types.h"
+#include <MESA/field_stat2.h>
+#define CONNECTION_HTTP_SINGLETHREAD	0x01
+#define CONNECTION_HTTP_MULTITHREAD		0x02
+#define CONNECTION_HTTP_STREAMING		0x03
+#define CONNECTION_RTSP					0x04
+#define CONNECTION_MMS					0x05
+#define CONNECTION_ED2K					0x06
+#define CONNECTION_ED2K_UDP				0x07
+
+#define CONNECTION_ED2K_CHEAT42				0x08
+#define CONNECTION_ED2K_CHEAT44				0x09
+#define CONNECTION_ED2K_CHEAT_ACK			0x10
+
+#define CONNECTION_FTP	            0x11
+#define CONNECTION_SMTP	            0x12
+#define CONNECTION_POP3	            0x13
+#define CONNECTION_IMAP	            0x14
+#define CONNECTION_RTMP				0x15
+
+
+
+#define HITTED_HTTP_REQUEST				0x01
+#define HITTED_HTTP_DATA				0x02
+#define HITTED_ED2K_PLAIN				0x03
+#define HITTED_ED2K_CRYPT				0x04
+#define HITTED_HTTP_REQUEST_STATIC      0x05
+#define HITTED_HTTP_DATA_STATIC         0x06
+
+#define HITTED_FTP_CONTROL_FILENAME		0x11
+#define HITTED_FTP_CONTROL_TRANSFER		0x12
+#define HITTED_FTP_DATA_S2C				0x13
+#define HITTED_FTP_DATA_C2S				0x14
+#define HITTED_FTP_CONTROL_STATIC		0x15
+#define HITTED_FTP_DATA_STATIC			0x16
+#define HITTED_SMTP_DATA				0x22
+#define HITTED_POP3_DATA				0x26
+#define HITTED_IMAP_DATA				0x2a
+#define HITTED_RTMP_REQUEST				0x30
+#define HITTED_RTMP_DATA 				0x31
+
+extern screen_stat_handle_t g_av_stat_handle;
+
+struct AV_block_info
+{
+	int connection_type;		//define in CONNECTION_**
+	int hitted_phase;				//define in HITTED_**
+	PROG_ID_t pid;
+	UINT64 filesize;	//file size,fill 0 while NOT acquired.
+	UINT64 range;					//program start offset, fill -1 while NOT acquired.
+	UCHAR file_type;			//define in AV_character.h FILE_**
+
+};
+#define	AVK_OPT_URL					0x01
+#define	AVK_OPT_RTSP_SESSION_ID		0x02
+#define	AVK_OPT_RTSP_UA				0x03
+
+int AV_kill_connection(struct streaminfo *stream,
+							struct ip *packet,
+							const struct AV_block_info *kill_info,
+							const struct opt_unit_t* block_opt,
+							int opt_num);
+int AV_kill_init(int max_thread_num);
+int AV_pollution_file(PROG_ID_t pid,UINT file_hdr_size,UINT file_pkt_size);
+
+#endif
diff --git a/src/inc/AV_log.h b/src/inc_soq/AV_log.h
index ab501c9..ab501c9 100644
--- a/src/inc/AV_log.h
+++ b/src/inc_soq/AV_log.h
diff --git a/src/inc_soq/AV_plugin_log.h b/src/inc_soq/AV_plugin_log.h
new file mode 100644
index 0000000..59201de
--- /dev/null
+++ b/src/inc_soq/AV_plugin_log.h
@@ -0,0 +1,40 @@
+#ifndef __AV_PLUGIN_LOG_H__
+#define	__AV_PLUGIN_LOG_H__
+
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+
+
+/* VOIP table_id */
+#define	TABLE_ID_LOG_JC_VOIP_STREAM				1
+#define	TABLE_ID_LOG_JC_VOIP_BLACKIP			193
+#define	TABLE_ID_LOG_JC_VOIP_BLACKACCOUNT		194
+#define	TABLE_ID_LOG_JC_VOIP_AUDIO_SAMPLE		195
+#define	TABLE_ID_LOG_JC_VOIP_AUDIO_SPEAK		196
+#define	TABLE_ID_LOG_JC_VOIP_AUDIO_LANG_WY		197
+
+typedef struct _log_opt
+{
+	int opt_type;
+	int opt_len;   /* length of opt_value  */
+	const void* opt_value;
+}log_opt_t;
+
+/*
+* arguments:
+ * 	arg1: �����Ӧ��ID
+ *	arg2����־ѡ������
+ *  arg3: ѡ��ĸ���
+ * returns:
+ *    �ɹ�ʱ���ط��ͳ��ȣ�ʧ��ʱ����С��0��ֵ
+ * 	-1, ������־��Ϣʧ��
+ *	-2, ����ʧ��
+ *	-3, ���͵ij��Ⱥ���ʵ���Ȳ����
+ *	-4,ip�����ڻ�portδ����
+*/
+
+int AV_plugin_send_log(const int table_id, log_opt_t* opt_array, int opt_num);
+
+#endif
+
diff --git a/src/inc/AV_prog_table.h b/src/inc_soq/AV_prog_table.h
index 1b66446..1b66446 100644
--- a/src/inc/AV_prog_table.h
+++ b/src/inc_soq/AV_prog_table.h
diff --git a/src/inc/AV_rule.h b/src/inc_soq/AV_rule.h
index 4763f6a..4763f6a 100644
--- a/src/inc/AV_rule.h
+++ b/src/inc_soq/AV_rule.h
diff --git a/src/inc_soq/AV_types.h b/src/inc_soq/AV_types.h
new file mode 100644
index 0000000..4522fcd
--- /dev/null
+++ b/src/inc_soq/AV_types.h
@@ -0,0 +1,92 @@
+#ifndef __AV_UTIL__H__
+#define __AV_UTIL__H__
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include <sys/types.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#if(__GNUC__ * 100 + __GNUC_MINOR__ * 10 + __GNUC_PATCHLEVEL__ >= 411)
+#define atomic_inc(x) __sync_add_and_fetch((x),1)
+#define atomic_dec(x) __sync_sub_and_fetch((x),1)
+#define atomic_add(x,y) __sync_add_and_fetch((x),(y))
+#define atomic_sub(x,y) __sync_sub_and_fetch((x),(y))
+typedef int atomic_t;
+#define ATOMIC_INIT(i)  { (i) }
+#define atomic_read(x) __sync_add_and_fetch((x),0)
+#define atomic_set(x,y) __sync_lock_test_and_set((x),y)
+#else 
+#include <alsa/iatomic.h>
+#endif 
+
+#ifndef MAX
+#define MAX(a, b)  (((a) > (b)) ? (a) : (b))
+#endif
+#ifndef MIN
+#define MIN(a, b)  (((a) < (b)) ? (a) : (b))
+#endif
+
+
+//Protocol Defination
+#define	MAX_THREAD_NUM		256
+#define	AV_PROTOCOL_MAX_NUM		256
+#define	AV_PROTOCOL_HTTP		0x01
+#define	AV_PROTOCOL_SMTP		0x02
+#define	AV_PROTOCOL_POP3		0x03
+#define	AV_PROTOCOL_FTP			0x04
+#define	AV_PROTOCOL_IMAP		0x05
+
+#define	AV_PROTOCOL_HTTP_STREAM	0x81
+#define	AV_PROTOCOL_RTSP_RDT	0x82
+#define	AV_PROTOCOL_RTSP_RTP	0x83
+#define	AV_PROTOCOL_ED2K		0x85
+#define	AV_PROTOCOL_MMS			0x84
+#define	AV_PROTOCOL_RTMP		0x86
+#define	AV_PROTOCOL_SIP			0x91
+
+
+
+#define	AV_PROTOCOL_BT		0x08
+
+
+typedef unsigned int   UINT;
+typedef unsigned char  UCHAR;
+typedef	unsigned long long UINT64;
+typedef unsigned int * UINTP;
+typedef unsigned char* UCHARP;
+typedef int  INT;
+typedef char CHAR;
+typedef int * INTP;
+typedef char* CHARP;
+typedef	unsigned long long PROG_ID_t;
+struct opt_unit_t {
+	UINT opt_len; /* ��ѡ����ֽڳ��ȣ��������ֶ� */
+	UCHAR opt_type; /* ��ѡ������� */
+	CHAR *opt_value; /* ��ѡ������� */
+};
+#define	OPT_HEADER_LEN	(sizeof(UINT)+sizeof(UCHAR))
+/***********************************************
+*Function: Add option to buf,return actual add size
+*Note:This function is used for 505 sendback option create.
+*Author:[email protected]
+*Date:2012-11-03
+***********************************************/
+int add_opt_505(char *buf,unsigned int buf_len, unsigned char opt_type,const char*opt_cont,unsigned int opt_cont_len);
+/***********************************************
+*Function: Read option from buf,return actual read size for jump over.
+*Note: opt_cont is a pointer to buf, NO memory assigned.
+*Author:[email protected]
+*Date:2014-08-14
+***********************************************/
+int read_opt_505(const char *buf,unsigned int buf_len, unsigned char *opt_type,const char**opt_cont,unsigned int *opt_cont_len);
+
+/***********************************************
+*return:deserialize opt_unit number>0 when success;
+*	     -1 when failed;
+***********************************************/
+
+int deserialize_opt_unit(char* opt_buff,int buff_len,unsigned int opt_num,struct opt_unit_t* opt_array,int array_size);
+									 
+#endif
+
diff --git a/src/inc_soq/MESA_trace.h b/src/inc_soq/MESA_trace.h
new file mode 100644
index 0000000..b2fce85
--- /dev/null
+++ b/src/inc_soq/MESA_trace.h
@@ -0,0 +1,122 @@
+#ifndef _MESA_TRACE_H_
+#define _MESA_TRACE_H_
+
+#include <netinet/in.h>            
+#include <netinet/ip.h>            
+#include <netinet/ip6.h> 
+
+#define H_TRACE_VERSION_1_20150204  0
+
+typedef	void* MESA_trace_addr_handle_t;
+typedef	void* MESA_trace_fullstr_handle_t;
+typedef	void* MESA_trace_substr_handle_t;
+
+struct trace_tuple4_v4
+{
+	unsigned int 			saddr;
+	unsigned int 			daddr;
+	unsigned short 		source;
+	unsigned short 		dest;
+};
+
+#ifndef IPV6_ADDR_LEN
+#define IPV6_ADDR_LEN	(sizeof(struct in6_addr))
+#endif
+
+struct trace_tuple4_v6
+{
+	unsigned char 		saddr[IPV6_ADDR_LEN] ;
+	unsigned char 		daddr[IPV6_ADDR_LEN] ;
+	unsigned short 		source;	
+	unsigned short 		dest;
+};
+
+enum trace_addr_type_t
+{
+	_TRACE_ADDR_TYPE_INIT = 0,
+	TRACE_ADDR_TYPE_IPV4,				
+	TRACE_ADDR_TYPE_IPV6,				
+};
+
+/*stream.h*/
+typedef struct 
+{
+	unsigned char addrtype;		
+	unsigned char pkttype;
+	unsigned char addrlen;
+	unsigned char __pad[5];
+	union
+	{		
+		struct trace_tuple4_v4 *tuple4_v4;
+		struct trace_tuple4_v6 *tuple4_v6;		
+	};
+}trace_layer_addr;
+
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+
+/*-------------------------------Part1-------------------------------------------*/
+/*
+*Paras: 			logger: trace runtime_log; 		 filename: configure file
+*Return: 			addr_trace_handle_t, NULL means error.
+*configure file form: 	addr_type\tsip\tsource\tdip\tdest  (separator : '\t', ' ', ';')
+*such as:
+*4	192.168.10.147		125		10.10.6.203		80
+*6	10::25:156::5			20662	10::25:156::45	80
+*4	0				0		0			0				0 (means all IPV4 tuple4)
+*6	0				0		0			0				0 (means all IPV6 tuple4)
+*/
+MESA_trace_addr_handle_t MESA_trace_create_addr_handle(void* logger, const char *filename);
+/*
+*Paras:   	handle: addr_trace_handle_t  		paddr:addr
+*Return:  	1 when match success, return 0 when match failed
+*/
+int MESA_trace_match_addr(MESA_trace_addr_handle_t handle, trace_layer_addr *paddr);
+void MESA_trace_destory_addr_handle(MESA_trace_addr_handle_t handle);
+/*--------------------------------Part2------------------------------------------*/
+/*
+*Paras: 			logger: trace runtime_log; 		 filename: configure file
+*Return: 			trace_substr_handle_t
+*configure file form: 	string
+*such as:
+*192.168.10.123:26662
+*10:25::68:58
+*then 192.168.10.123:2545-55.25.65.55:123 will match
+*/
+MESA_trace_substr_handle_t MESA_trace_create_substr_handle(void* logger, const char *filename);
+/*
+*Paras:   	handle: trace_substr_handle_t ;	str:      str_len:
+*Return:  	1 when match success, return 0 when match failed
+*func:		sub match
+*/
+int  MESA_trace_match_substr(MESA_trace_substr_handle_t handle, const char *str, int str_len);
+void MESA_trace_destory_substr_handle(MESA_trace_substr_handle_t handle);
+
+/*-------------------------------Part3-------------------------------------------*/
+/*
+*Paras: 				logger: trace runtime_log;  filename: configure file
+*Return: 			trace_fullstr_handle_t
+*configure file form:	string
+*such as:
+*HTTP
+*MAIL
+*then HTTP will match , HTTP_UP will not match
+*/
+MESA_trace_fullstr_handle_t MESA_trace_create_fullstr_handle(void* logger, const char *filename);
+/*
+*Paras:   	handle: addr_trace_handle_t ;  	str:      str_len:
+*Return:  	1 when match success, return 0 when match failed
+*func:		complete match
+*/
+int  MESA_trace_match_fullstr(MESA_trace_fullstr_handle_t handle, const char *str, int str_len);
+void MESA_trace_destory_fullstr_handle(MESA_trace_fullstr_handle_t handle);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
+
diff --git a/src/inc_soq/Maat_command.h b/src/inc_soq/Maat_command.h
new file mode 100644
index 0000000..5d2b6b9
--- /dev/null
+++ b/src/inc_soq/Maat_command.h
@@ -0,0 +1,152 @@
+#ifndef H_MAAT_COMMAND_H_INCLUDE
+#define H_MAAT_COMMAND_H_INCLUDE
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include "Maat_rule.h"
+enum MAAT_OPERATION
+{
+	MAAT_OP_DEL=0,
+	MAAT_OP_ADD
+};
+ 
+enum MAAT_REGION_TYPE
+{
+	REGION_EXPR,
+	REGION_IP,
+	REGION_INTERVAL,
+	REGION_DIGEST,
+	REGION_SIMILARITY
+};
+enum MAAT_EXPR_TYPE
+{	
+	EXPR_TYPE_STRING=0,
+	EXPR_TYPE_AND,
+	EXPR_TYPE_REGEX,
+	EXPR_TYPE_OFFSET
+};
+enum MAAT_MATCH_METHOD
+{	
+	MATCH_METHOD_SUB=0,
+	MATCH_METHOD_RIGHT,
+	MATCH_METHOD_LEFT,
+	MATCH_METHOD_COMPLETE
+};
+
+enum MAAT_CASE_TYPE
+{
+	UNCASE_PLAIN=0,
+	CASE_HEXBIN,
+	CASE_PLAIN
+};
+enum MAAT_ADDR_TYPE
+{
+	ADDR_TYPE_IPv4=4,
+	ADDR_TYPE_IPv6=6
+};
+enum MAAT_ADDR_DIRECTION
+{
+	ADDR_DIR_DOUBLE=0,
+	ADDR_DIR_SINGLE=1
+};
+struct Maat_rgn_str_t
+{
+	const char *keywords;
+	const char *district;// optional for expr_plus, otherwise set to NULL.
+	enum MAAT_EXPR_TYPE expr_type;
+	enum MAAT_MATCH_METHOD match_method;
+	enum MAAT_CASE_TYPE hex_bin;
+};
+struct Maat_rgn_addr_t
+{
+	enum MAAT_ADDR_TYPE addr_type;
+	const char* src_ip;
+	const char* mask_src_ip;
+	const char* dst_ip;
+	const char* mask_dst_ip;
+	unsigned short src_port;
+	unsigned short mask_src_port;
+	unsigned short dst_port;
+	unsigned short mask_dst_port;
+	unsigned short protocol;
+	enum MAAT_ADDR_DIRECTION direction;
+};
+struct Maat_rgn_intv_t
+{
+	unsigned int low_boundary;
+	unsigned int up_boundary;
+};
+struct Maat_rgn_digest_t
+{
+	unsigned long long orgin_len;
+	const char* digest_string;
+	short confidence_degree;
+};
+struct Maat_rgn_sim_t
+{
+	char* target;
+	short threshold;// 1~100
+};
+struct Maat_region_t
+{
+	const char* table_name;
+	int region_id;	//If MAAT_OPT_CMD_AUTO_NUMBERING==1, maat will assigned one. Or users must appoint a unique number.
+	enum MAAT_REGION_TYPE region_type;
+	union
+	{
+		struct Maat_rgn_str_t expr_rule;
+		struct Maat_rgn_addr_t ip_rule;
+		struct Maat_rgn_intv_t interval_rule;
+		struct Maat_rgn_digest_t digest_rule;
+		struct Maat_rgn_sim_t similarity_rule;
+	};
+};
+struct Maat_group_t
+{
+	int region_num;
+	int group_id;	//If MAAT_OPT_CMD_AUTO_NUMBERING==1, maat will assigned one. Or users must assign a unique number.
+	struct Maat_region_t *regions;	
+};
+struct Maat_cmd_t
+{
+	struct Maat_rule_t compile; // for MAAT_OP_DEL, only compile.config_id is necessary.
+	int group_num;				// for MAAT_OP_DEL, set to 0.
+	int expire_after;			//expired after $expire_after$ seconds, set to 0 for never timeout.
+	int label_id;					//>0, to be indexed and quried by Maat_cmd_select; =0 not index
+	struct Maat_group_t* groups;// Add regions with Maat_add_region2cmd 
+};
+struct Maat_line_t
+{
+	const char* table_name;
+	const char* table_line;
+	int rule_id;		// for MAAT_OP_DEL, only rule_id is necessary.
+	int label_id;
+	int expire_after;	//expired after $timeout$ seconds, set to 0 for never timeout.
+};
+struct Maat_cmd_t* Maat_create_cmd(const struct Maat_rule_t* rule, int group_num);
+//input: which_group 0~group_num
+//input: region can be freed after added.
+void Maat_add_region2cmd(struct Maat_cmd_t* cmd,int which_group,const struct Maat_region_t* region);
+
+void Maat_free_cmd(struct Maat_cmd_t* cmd);
+int Maat_format_cmd(struct Maat_cmd_t* cmd, char* buffer, int size);
+// REGION_EXPR and REGION_SIMILARITY need to escape input string.
+char* Maat_str_escape(char* dst,int size,const char*src);
+
+// The following functions are NOT thread safe.
+int Maat_cmd(Maat_feather_t feather,struct Maat_cmd_t* cmd,enum MAAT_OPERATION op);
+
+//pipeline model
+int Maat_cmd_append(Maat_feather_t feather,struct Maat_cmd_t* cmd,enum MAAT_OPERATION op);
+int Maat_cmd_commit(Maat_feather_t feather);
+
+
+int Maat_cmd_set_group(Maat_feather_t feather, int group_id, const struct Maat_region_t* region, enum MAAT_OPERATION op);
+int Maat_cmd_set_line(Maat_feather_t feather,const struct Maat_line_t* line_rule, enum MAAT_OPERATION op);
+
+//Return the value of key after the increment.
+//If the key does not exist, it is set to 0 before performing the operation.
+long long Maat_cmd_incrby(Maat_feather_t feather,const char* key, int increment);
+int Maat_cmd_select(Maat_feather_t feather, int label_id, int * output_ids, unsigned int size);
+#endif
+
diff --git a/src/inc_soq/Maat_rule.h b/src/inc_soq/Maat_rule.h
new file mode 100644
index 0000000..e160a4a
--- /dev/null
+++ b/src/inc_soq/Maat_rule.h
@@ -0,0 +1,228 @@
+
+/*
+*****************Maat Network Flow Rule Manage Framework********
+*	Maat is the Goddess of truth and justice in ancient Egyptian concept.
+*	Her feather was the measure that determined whether the souls (considered 
+*	to reside in the heart) of the departed would reach the paradise of afterlife
+*	successfully.
+*	Author: [email protected],MESA
+*	Version 2015-11-09 digest scan
+*	NOTE: MUST compile with G++
+*	All right reserved by Institute of Infomation Engineering,Chinese Academic of Science 2014~2018
+*********************************************************
+*/
+#ifndef H_MAAT_RULE_H_INCLUDE
+#define H_MAAT_RULE_H_INCLUDE
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+#include "stream.h"
+enum MAAT_CHARSET
+{
+	CHARSET_NONE=0,
+	CHARSET_GBK,
+	CHARSET_BIG5,
+	CHARSET_UNICODE,
+	CHARSET_UTF8,	// 4
+	CHARSET_BIN,	//5
+	CHARSET_UNICODE_ASCII_ESC,		// Unicode Escape format, prefix backslash-u hex, e.g. "\u627;"
+	CHARSET_UNICODE_ASCII_ALIGNED,//Unicode Escape format, prefix backslash-u with 4 bytes aligned, e.g. "\u0627"
+	CHARSET_UNICODE_NCR_DEC,		//SGML Numeric character reference,decimal base, e.g. "&#1575;"
+	CHARSET_UNICODE_NCR_HEX,		//SGML Numeric character reference,hexdecimal base, e.g. "&#x627;"
+	CHARSET_URL_ENCODE_GB2312,		//URL encode with GB2312, e.g. the chinese word "china" was encoded to %D6%D0%B9%FA
+	CHARSET_URL_ENCODE_UTF8		//11, URL encode with UTF8,e.g. the chinese word "china" was encoded to %E4%B8%AD%E5%9B%BD
+};
+enum MAAT_ACTION
+{
+	MAAT_ACTION_BLOCK=0,
+	MAAT_ACTION_MONIT,
+	MAAT_ACTION_WHITE
+};
+enum MAAT_POS_TYPE
+{
+	MAAT_POSTYPE_EXPR=0,
+	MAAT_POSTYPE_REGEX
+};
+typedef	void*	scan_status_t;
+typedef	void*	stream_para_t;
+typedef	void*	Maat_feather_t;
+
+
+#define	MAX_SERVICE_DEFINE_LEN	128
+struct Maat_rule_t
+{
+	int		config_id;
+	int		service_id;
+	char	do_log;
+	char 	do_blacklist;
+	char	action;
+	char	resevered;
+	int		serv_def_len;
+	char 	service_defined[MAX_SERVICE_DEFINE_LEN];
+};
+#define	MAAT_RULE_UPDATE_TYPE_FULL	1
+#define	MAAT_RULE_UPDATE_TYPE_INC	2
+typedef void Maat_start_callback_t(int update_type,void* u_para);
+typedef void Maat_update_callback_t(int table_id,const char* table_line,void* u_para);
+typedef void Maat_finish_callback_t(void* u_para);
+
+
+
+
+
+//--------------------HITTING DETAIL DESCRIPTION BEGIN
+
+#define	MAAT_MAX_HIT_RULE_NUM		8
+#define MAAT_MAX_EXPR_ITEM_NUM		8
+#define	MAAT_MAX_HIT_POS_NUM		8
+#define	MAAT_MAX_REGEX_GROUP_NUM	8
+
+//NOTE position buffer as hitting_regex_pos and hit_pos,are ONLY valid before next scan or Maat_stream_scan_string_end
+struct regex_pos_t
+{
+	int group_num;
+	int hitting_regex_len;
+	const char* hitting_regex_pos;
+	int grouping_len[MAAT_MAX_REGEX_GROUP_NUM];
+	const char* grouping_pos[MAAT_MAX_REGEX_GROUP_NUM];
+};
+struct str_pos_t
+{
+	int hit_len;
+	const char* hit_pos;
+};
+struct sub_item_pos_t
+{
+	enum MAAT_POS_TYPE ruletype;
+	int hit_cnt;
+	union
+	{
+		struct regex_pos_t	regex_pos[MAAT_MAX_HIT_POS_NUM];
+		struct str_pos_t substr_pos[MAAT_MAX_HIT_POS_NUM];
+	};
+};
+
+struct Maat_region_pos_t
+{
+	
+	int region_id;
+	int sub_item_num;
+	struct sub_item_pos_t sub_item_pos[MAAT_MAX_EXPR_ITEM_NUM];	
+};
+
+struct Maat_hit_detail_t
+{
+	int config_id;//set <0 if half hit;
+	int hit_region_cnt;
+	struct Maat_region_pos_t region_pos[MAAT_MAX_HIT_RULE_NUM];	
+};
+//--------------------HITTING DETAIL DESCRIPTION END
+
+//Abondon interface ,left for compatible.
+Maat_feather_t Maat_summon_feather(int max_thread_num,
+								const char* table_info_path,
+								const char* ful_cfg_dir,
+								const char* inc_cfg_dir,
+								void*logger);//MESA_handle_logger
+//Abondon interface ,left for compatible. 
+Maat_feather_t Maat_summon_feather_json(int max_thread_num,
+									const char* table_info_path,
+									const char* json_rule,
+									void* logger);
+
+Maat_feather_t Maat_feather(int max_thread_num,const char* table_info_path,void* logger);
+int Maat_initiate_feather(Maat_feather_t feather);
+
+enum MAAT_INIT_OPT
+{
+	MAAT_OPT_SCANDIR_INTERVAL_MS=1,	//VALUE is interger, SIZE=sizeof(int). DEFAULT:1,000 milliseconds.
+	MAAT_OPT_EFFECT_INVERVAL_MS,	//VALUE is interger, SIZE=sizeof(int). DEFAULT:60,000 milliseconds.
+	MAAT_OPT_FULL_CFG_DIR,			//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1.DEFAULT: no default.
+	MAAT_OPT_INC_CFG_DIR,			//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1.DEFAULT: no default.
+	MAAT_OPT_JSON_FILE_PATH,		//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1.DEFAULT: no default.
+	MAAT_OPT_STAT_ON,				//VALUE is  NULL,SIZE is 0. MAAT_OPT_STAT_FILE_PATH must be set. Default: stat OFF.
+	MAAT_OPT_PERF_ON,				//VALUE is NULL,SIZE is 0. MAAT_OPT_STAT_FILE_PATH must be set. Default: stat OFF.
+	MAAT_OPT_STAT_FILE_PATH,		//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. DEFAULT: no default.
+	MAAT_OPT_SCAN_DETAIL,			//VALUE is interger *, SIZE=sizeof(int). 0: not return any detail;1: return  hit pos, not include regex grouping;
+									//  2 return hit pos and regex grouping pos;DEFAULT:0
+	MAAT_OPT_INSTANCE_NAME,			//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1, no more than 11 bytes.DEFAULT: MAAT_$tableinfo_path$.
+	MAAT_OPT_DECRYPT_KEY,			//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. No DEFAULT.
+	MAAT_OPT_REDIS_IP,				//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. No DEFAULT.
+	MAAT_OPT_REDIS_PORT,			//VALUE is a unsigned short, host order, SIZE= sizeof(unsigned short). No DEFAULT.
+	MAAT_OPT_REDIS_INDEX,			//VALUE is interger *, 0~15, SIZE=sizeof(int). DEFAULT: 0.
+	MAAT_OPT_CMD_AUTO_NUMBERING,		//VALUE is interger *, 1 or 0, SIZE=sizeof(int). DEFAULT: 1.
+	MAAT_OPT_DEFERRED_LOAD			//VALUE is  NULL,SIZE is 0.  Default: Deffered initialization OFF.
+};
+//return -1 if failed, return 0 on success;
+int Maat_set_feather_opt(Maat_feather_t feather,enum MAAT_INIT_OPT  type,const void* value,int size);
+void Maat_burn_feather(Maat_feather_t feather);
+
+//return table_id(>=0) if success,otherwise return -1;
+int Maat_table_register(Maat_feather_t feather,const char* table_name);
+//return 1 if success,otherwise return -1 incase invalid table_id or registed function number exceed 32;
+int Maat_table_callback_register(Maat_feather_t feather,short table_id,
+									Maat_start_callback_t *start,//MAAT_RULE_UPDATE_TYPE_*,u_para
+									Maat_update_callback_t *update,//table line ,u_para
+									Maat_finish_callback_t *finish,//u_para
+									void* u_para);
+
+enum MAAT_SCAN_OPT
+{
+	MAAT_SET_SCAN_DISTRICT=1,		//VALUE is a const char*,SIZE= strlen(string).DEFAULT: no default.
+	MAAT_SET_SCAN_LAST_REGION		//VALUE is NULL, SIZE=0. This option indicates that the follow scan is the last region of current scan cobination.
+};
+//return 0 if success, return -1 when failed;
+int Maat_set_scan_status(Maat_feather_t feather,scan_status_t* mid,enum MAAT_SCAN_OPT type,const void* value,int size);
+
+//Return hit rule number, return -1 when error occurs,return -2 when hit current region
+//mid MUST set NULL before fist call
+int Maat_scan_intval(Maat_feather_t feather,int table_id
+						,unsigned int intval
+						,struct Maat_rule_t*result,int rule_num
+						,scan_status_t *mid,int thread_num);
+int Maat_scan_addr(Maat_feather_t feather,int table_id
+						,struct ipaddr* addr
+						,struct Maat_rule_t*result,int rule_num
+						,scan_status_t *mid,int thread_num);
+int Maat_scan_proto_addr(Maat_feather_t feather,int table_id
+						,struct ipaddr* addr,unsigned short int proto
+						,struct Maat_rule_t*result,int rule_num
+						,scan_status_t *mid,int thread_num);
+int Maat_full_scan_string(Maat_feather_t feather,int table_id
+						,enum MAAT_CHARSET charset,const char* data,int data_len
+						,struct Maat_rule_t*result,int* found_pos,int rule_num
+						,scan_status_t* mid,int thread_num);
+//hite_detail could be NULL if unconcern
+int Maat_full_scan_string_detail(Maat_feather_t feather,int table_id
+						,enum MAAT_CHARSET charset,const char* data,int data_len
+						,struct Maat_rule_t*result,int rule_num,struct Maat_hit_detail_t *hit_detail,int detail_num
+						,int* detail_ret,scan_status_t* mid,int thread_num);
+
+stream_para_t Maat_stream_scan_string_start(Maat_feather_t feather,int table_id,int thread_num);
+int Maat_stream_scan_string(stream_para_t* stream_para
+									,enum MAAT_CHARSET charset,const char* data,int data_len
+									,struct Maat_rule_t*result,int* found_pos,int rule_num
+									,scan_status_t* mid);
+//hited_detail could be NULL if unconcern
+int Maat_stream_scan_string_detail(stream_para_t* stream_para
+									,enum MAAT_CHARSET charset,const char* data,int data_len
+									,struct Maat_rule_t*result,int rule_num,struct Maat_hit_detail_t *hit_detail,int detail_num
+									,int* detail_ret,scan_status_t* mid);
+void Maat_stream_scan_string_end(stream_para_t* stream_para);
+
+stream_para_t Maat_stream_scan_digest_start(Maat_feather_t feather,int table_id,unsigned long long total_len,int thread_num);
+int Maat_stream_scan_digest(stream_para_t* stream_para
+									,const char* data,int data_len,unsigned long long offset
+									,struct Maat_rule_t*result,int rule_num
+									,scan_status_t* mid);
+void Maat_stream_scan_digest_end(stream_para_t* stream_para);
+
+int Maat_similar_scan_string(Maat_feather_t feather,int table_id
+						,const char* data,int data_len
+						,struct Maat_rule_t*result,int rule_num
+						,scan_status_t* mid,int thread_num);
+
+void Maat_clean_status(scan_status_t* mid);
+
+#endif	//	H_MAAT_RULE_H_INCLUDE
+
diff --git a/src/inc_soq/field_stat2.h b/src/inc_soq/field_stat2.h
new file mode 100644
index 0000000..2c64780
--- /dev/null
+++ b/src/inc_soq/field_stat2.h
@@ -0,0 +1,66 @@
+#ifndef H_SCREEN_STAT_H_INCLUDE
+#define H_SCREEN_STAT_H_INCLUDE
+#include <stdio.h>
+
+#ifndef __cplusplus
+#error("This file should be compiled with C++ compiler")
+#endif
+
+enum field_dsp_style_t
+{
+	FS_STYLE_FIELD=0,
+	FS_STYLE_COLUMN,
+	FS_STYLE_LINE,
+	FS_STYLE_STATUS
+};
+enum field_calc_algo
+{
+	FS_CALC_CURRENT=0,
+	FS_CALC_SPEED
+};
+enum field_op
+{
+	FS_OP_ADD=1,
+	FS_OP_SET
+};
+
+
+typedef	void* screen_stat_handle_t;
+
+enum FS_option
+{
+	OUTPUT_DEVICE,		//VALUE is a const char*, indicate a  file path string, SIZE = strlen(string+'\0')+1.DEFAULT:output to stdout.
+	PRINT_MODE,			//VALUE is an interger,1:Rewrite ,2: Append. SIZE=4,DEFALUT:REWRITE.
+	STAT_CYCLE,			//VALUE is an interger idicate interval seconds of every output, SIZE=4 ,DEFUALT:2 seconds.
+	PRINT_TRIGGER,		//VALUE is an interger,1:Do print,0: Don't print.SIZE=4.DEFAULT:1.
+	CREATE_THREAD,		//VALUE is an interger,1: Create a print thread,0:not create,output by call passive_output function,
+						//and the STAT_CYCLE is meaningless.SIZE=4,DEFAULT:0.
+	ID_INVISBLE,		//value is field_id/status_id/column_id, not output this string, SIZE=4,DEFAULT: shutdown NO one.
+	FLUSH_BY_DATE,		//value is 1(ture) or 0(false),SIZE=4,DEFAULT: Do not flush by date.
+	APP_NAME,			//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. DEFAULT is "?".
+	STATS_SERVER_IP, 	//VALUE is a const char*, MUST end with '\0', SIZE= strlen(string+'\0')+1. No DEFAULT.
+	STATS_SERVER_PORT, 	//VALUE is a unsigned short, host order, SIZE= sizeof(unsigned short). No DEFAULT.
+};
+
+//Always success.
+screen_stat_handle_t FS_create_handle(void);
+
+int FS_set_para(screen_stat_handle_t handle, enum FS_option  type,const void* value,int size);
+void FS_start(screen_stat_handle_t handle);
+void FS_stop(screen_stat_handle_t* handle);
+
+//return field_id/line_id/column_id greater than zero if success,return an interger less than zero if failed.
+//should NOT include "|:\n\r.\t<>[]#!@"or space in the parameter name.
+int FS_register(screen_stat_handle_t handle,enum field_dsp_style_t style,enum field_calc_algo calc_type,const char* name);
+
+//numerator_id and denominator_id must be column/field/status style.
+//scaling: negative value: zoom in; positive value: zoom out;
+int FS_register_ratio(screen_stat_handle_t handle,int numerator_id,int denominator_id,int scaling,enum field_dsp_style_t style,enum field_calc_algo calc_type,const char* name);
+
+//id: when id's type is FIELD , column_id is ignore.
+int FS_operate(screen_stat_handle_t handle,int id,int column_id,enum field_op op,long long value);
+
+void FS_passive_output(screen_stat_handle_t handle);
+
+#endif
+
diff --git a/src/inc_soq/http.h b/src/inc_soq/http.h
new file mode 100644
index 0000000..4e113d9
--- /dev/null
+++ b/src/inc_soq/http.h
@@ -0,0 +1,236 @@
+#ifndef HTTP_H_
+#define HTTP_H_
+
+#define    HTTP_H_VERSION_4_20160905     	0
+//#define    HTTP_H_VERSION_3_20150320     	0
+//20160905 add http_line2region
+
+#ifndef uchar
+typedef unsigned char           uchar;
+#endif
+#ifndef int64
+typedef long long               int64;
+#endif
+#ifndef uint8
+typedef unsigned char           uint8;
+#endif
+#ifndef uint64
+typedef unsigned long long      uint64;
+#endif
+#ifndef uint32
+typedef unsigned int            uint32;
+#endif
+#ifndef uint16
+typedef unsigned short          uint16;
+#endif
+
+/*interest region*/
+typedef enum
+{
+	/*#http_special1*/
+	HTTP_INTEREST_KEY_MASK=0,		
+	HTTP_ALL_MASK,
+	HTTP_OTHER_REGIONS_MASK,
+	HTTP_STATE_MASK,
+	HTTP_REQ_LINE_MASK,
+	HTTP_RES_LINE_MASK,	
+	HTTP_CONTENT_MASK,             
+	HTTP_UNGZIP_CONTENT_MASK,
+	HTTP_MESSAGE_URL_MASK,
+	HTTP_URI_MASK,
+
+	/*#http_request*/
+	HTTP_HOST_MASK,	
+	HTTP_REFERER_MASK,
+	HTTP_USER_AGENT_MASK,
+	HTTP_COOKIE_MASK,
+	HTTP_PROXY_AUTHORIZATION_MASK,
+	HTTP_AUTHORIZATION_MASK,
+	
+	/*#http_response*/	
+	HTTP_LOCATION_MASK,
+	HTTP_SERVER_MASK,
+	HTTP_ETAG_MASK,
+
+	/*#http_general*/	
+	HTTP_DATE_MASK,
+	HTTP_TRAILER_MASK,
+	HTTP_TRANSFER_ENCODING_MASK,
+	HTTP_VIA_MASK,
+	HTTP_PRAGMA_MASK,
+	HTTP_CONNECTION_MASK,
+
+	/*#http_content*/	
+	HTTP_CONT_ENCODING_MASK,
+	HTTP_CONT_LANGUAGE_MASK,
+	HTTP_CONT_LOCATION_MASK,	
+	HTTP_CONT_DISPOSITION_MASK,
+	HTTP_CONT_RANGE_MASK,
+	HTTP_CONT_LENGTH_MASK,
+	HTTP_CONT_TYPE_MASK,
+	HTTP_CHARSET_MASK,
+	HTTP_EXPIRES_MASK,
+	HTTP_X_FLASH_VERSION_MASK,	
+	HTTP_TRANSFER_LENGTH_MASK,
+
+	HTTP_REGION_NUM=36,	
+}interested_region_mask;
+/*HTTP_REGION_NUM=36*/
+#define HTTP_INTEREST_KEY				((long long)1<<HTTP_INTEREST_KEY_MASK)
+#define HTTP_ALL						((long long)1<<HTTP_ALL_MASK)
+#define HTTP_OTHER_REGIONS				((long long)1<<HTTP_OTHER_REGIONS_MASK)
+#define HTTP_STATE						((long long)1<<HTTP_STATE_MASK)
+#define HTTP_REQ_LINE					((long long)1<<HTTP_REQ_LINE_MASK)
+#define HTTP_RES_LINE					((long long)1<<HTTP_RES_LINE_MASK)
+#define HTTP_CONTENT					((long long)1<<HTTP_CONTENT_MASK)
+#define HTTP_UNGZIP_CONTENT				((long long)1<<HTTP_UNGZIP_CONTENT_MASK)
+#define HTTP_MESSAGE_URL				((long long)1<<HTTP_MESSAGE_URL_MASK)
+#define HTTP_URI						((long long)1<<HTTP_URI_MASK)
+
+#define HTTP_HOST						((long long)1<<HTTP_HOST_MASK)
+#define HTTP_REFERER					((long long)1<<HTTP_REFERER_MASK)
+#define HTTP_USER_AGENT					((long long)1<<HTTP_USER_AGENT_MASK)
+#define HTTP_COOKIE						((long long)1<<HTTP_COOKIE_MASK)
+#define HTTP_PROXY_AUTHORIZATION		((long long)1<<HTTP_PROXY_AUTHORIZATION_MASK)
+#define HTTP_AUTHORIZATION				((long long)1<<HTTP_AUTHORIZATION_MASK)
+
+#define HTTP_LOCATION					((long long)1<<HTTP_LOCATION_MASK)
+#define HTTP_SERVER						((long long)1<<HTTP_SERVER_MASK)
+#define HTTP_ETAG 						((long long)1<<HTTP_ETAG_MASK)
+
+#define HTTP_DATE 						((long long)1<<HTTP_DATE_MASK)
+#define HTTP_TRAILER 					((long long)1<<HTTP_TRAILER_MASK)
+#define HTTP_TRANSFER_ENCODING			((long long)1<<HTTP_TRANSFER_ENCODING_MASK)
+#define HTTP_VIA						((long long)1<<HTTP_VIA_MASK)
+#define HTTP_PRAGMA						((long long)1<<HTTP_PRAGMA_MASK)
+#define HTTP_CONNECTION 				((long long)1<<HTTP_CONNECTION_MASK)
+
+#define HTTP_CONT_ENCODING 				((long long)1<<HTTP_CONT_ENCODING_MASK)
+#define HTTP_CONT_LANGUAGE 				((long long)1<<HTTP_CONT_LANGUAGE_MASK)
+#define HTTP_CONT_LOCATION 				((long long)1<<HTTP_CONT_LOCATION_MASK)
+#define HTTP_CONT_RANGE 				((long long)1<<HTTP_CONT_RANGE_MASK)
+#define HTTP_CONT_LENGTH 				((long long)1<<HTTP_CONT_LENGTH_MASK)
+#define HTTP_CONT_TYPE 					((long long)1<<HTTP_CONT_TYPE_MASK)
+#define HTTP_CONT_DISPOSITION			((long long)1<<HTTP_CONT_DISPOSITION_MASK)
+#define HTTP_CHARSET 					((long long)1<<HTTP_CHARSET_MASK)
+#define HTTP_EXPIRES 					((long long)1<<HTTP_EXPIRES_MASK)
+#define HTTP_X_FLASH_VERSION 			((long long)1<<HTTP_X_FLASH_VERSION_MASK)
+#define HTTP_TRANSFER_LENGTH 			((long long)1<<HTTP_TRANSFER_LENGTH_MASK)
+
+/*http_state*/
+#define HTTP_STATE_UNKNOWN 				0x00
+#define HTTP_START_LINE					0x01 /*start line over*/
+#define HTTP_REGION 						0x02 
+#define HTTP_DATA_BEGIN 					0x03 /*header over*/
+#define HTTP_DATA 						0x04 /*have entity*/
+#define HTTP_DATA_END 					0x05
+
+/*���ݱ��뷽ʽcont_encoding*/
+#define HTTP_CONT_ENCOD_UNKNOWN 		0X00//��ʼ״̬
+#define HTTP_CONT_ENCOD_DEFAULT 		0X01
+#define HTTP_CONT_ENCOD_GZIP 			0X02
+#define HTTP_CONT_ENCOD_COMPRESS 		0X03
+#define HTTP_CONT_ENCOD_DEFLATE 		0X04
+#define HTTP_CONT_ENCOD_OTHERS 			0X05
+
+/*������뷽ʽtran_encoding*/
+#define HTTP_TRANS_ENCOD_UNKNOWN 		0X00//��ʼ״̬
+#define HTTP_TRANS_ENCOD_CHUNKED 		0X01//chunked����13
+#define HTTP_TRANS_ENCOD_DEFAULT 		0X02//default
+#define HTTP_TRANS_ENCOD_OTHERS 		0X03//����״̬
+
+/*���󷽷�method*/
+#define HTTP_METHOD_UNKNOWN				0X00//��ʼ״̬
+#define HTTP_METHOD_GET 					0X01
+#define HTTP_METHOD_POST 				0X02
+#define HTTP_METHOD_CONNECT				0X03
+#define HTTP_METHOD_HEAD				0X04
+#define HTTP_METHOD_PUT					0X05
+#define HTTP_METHOD_OPTIONS				0X06
+#define HTTP_METHOD_DELETE				0X07
+#define HTTP_METHOD_TRACE				0X08
+
+
+typedef struct _cont_range_t
+{
+	uint64 	start;
+	uint64 	end;
+	uint64 	len;
+}cont_range_t;
+
+typedef struct _append_infor_t
+{	
+	char* 					content;   //data: origin data when ungzip;     region:all complete line when enpand region
+	uint32 					contlen;
+}append_infor_t;
+
+typedef struct _region_t
+{	
+	char* 					pdata;   
+	uint32 					datalen;
+}region_t;
+
+typedef struct _field_infor_t
+{
+	long long 					prot_flag;       //��ǰ�ֶ�flag
+	void*						buf;			   //��ǰ����֮����ֶ�
+	void*						src_buf;		   //��չ�ֶ�ָ�������У�����ָ��ԭʼ����(��ѹ��֮ǰ����ͬ�Ľ������Խ���)
+	int							buflen;		   //��ǰ�ֶγ���
+	int							src_buflen;	    //��ǰ�ֶγ���
+}field_infor_t;
+
+typedef struct _batch_infor_t
+{
+	int							field_cnt;     	 //���������ֶ���Ŀ
+	field_infor_t*				field;	     		 //�ֶ���Ϣ��stFieldInfo
+}batch_infor_t;
+
+typedef struct http_infor_t
+{	
+	char*					p_url;		
+	uint32 					url_len;	
+	int 					http_session_seq;			
+	uint64 					cont_length;			
+	cont_range_t* 			cont_range;	
+	
+	uchar					curdir;	
+	uchar 					http_state;		    
+	uchar 					cont_encoding;
+	uchar 					trans_encoding;  
+	
+	uchar					method;	
+	uchar 					_pad_;	
+	uint16 					res_code;
+	append_infor_t			append_infor;	
+	batch_infor_t*			batch_infor;
+}http_infor;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+*����������(key:value)���key ��key_len
+*����ֵ0�ɹ���-1:ʧ��
+*_key_:_value,ֻ����key
+*/
+int http_line2region(const char *line, uint32 line_len, char** region, uint32* region_len);
+/*
+* �����ֶ�����region ����ֶε�proto_flag
+* region : ������host (in pcap)��Ҳ������HTTP_HOST(in http.conf)
+*/
+long long http_region2proto_flag(const char *region, uint32 region_len);
+/*
+*����proto_flag����ֶ�����
+*����ֵ��http.conf�е��ַ���
+*/
+const char* http_proto_flag2region(long long proto_flag);
+const char* http_get_method(uchar method);
+char* http_url_decode(char *data,  int* data_len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif 
+ 
diff --git a/src/inc_soq/opt.h b/src/inc_soq/opt.h
new file mode 100644
index 0000000..028972d
--- /dev/null
+++ b/src/inc_soq/opt.h
@@ -0,0 +1,56 @@
+#ifndef _OPT_H
+#define _OPT_H
+
+
+#ifndef INT64_H
+#define INT64_H	
+typedef long long				int64;
+#endif
+
+#ifndef U_INT8_H
+#define U_INT8_H
+typedef unsigned char			uint8;
+#endif
+
+#ifndef U_INT64_H
+#define U_INT64_H
+typedef unsigned long long		uint64;
+#endif
+
+#ifndef U_INT16_H
+#define U_INT16_H
+typedef unsigned short			uint16;
+#endif
+
+#ifndef U_LONG64_H
+#define U_LONG64_H
+typedef unsigned long			ulong64;
+#endif
+
+#ifndef U_INT32_H
+#define U_INT32_H
+typedef unsigned int			uint32;
+#endif
+
+
+#define OPT_STATUS_COMPLETE		0
+#define OPT_STATUS_FRAG			1
+#define OPT_STATUS_FRAG_END		2
+
+typedef void* opt_t;
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+opt_t	create_opt(int opt_type, int opt_status, const char* opt_name, const void* opt_value, uint32 opt_len);
+void 	destroy_opt(opt_t opt);
+
+void	append_nested_opt(opt_t ext_opt, opt_t inner_opt);
+uint32 	get_opt_size(opt_t opt);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/inc_soq/opt_in.h b/src/inc_soq/opt_in.h
new file mode 100644
index 0000000..de45b13
--- /dev/null
+++ b/src/inc_soq/opt_in.h
@@ -0,0 +1,18 @@
+#ifndef _OPT_IN_H
+#define _OPT_IN_H
+
+#include "MESA_list_queue.h"
+
+typedef struct opt_elem_s
+{
+	int							opt_type;
+	int							opt_status;       //may not set
+	char 						opt_name[64];	  
+	void* 						opt_value;
+	uint32 						opt_len;	
+	uint32 						opt_size;
+    MESA_lqueue_head 			subopt_list_head; 
+	int							layer_num;  	  //0 1 2 3 4 ...;for add ">>"		
+}opt_elem_t;
+
+#endif
diff --git a/src/inc_soq/optregister.h b/src/inc_soq/optregister.h
new file mode 100644
index 0000000..ae42001
--- /dev/null
+++ b/src/inc_soq/optregister.h
@@ -0,0 +1,24 @@
+#ifndef _OPTREGISTER_H
+#define _OPTREGISTER_H
+
+#include "opt.h"
+
+typedef void* optregister_t;
+typedef void (* optregister_cb_t)(opt_t opt);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+optregister_t  	create_optregister(const uint32 size);
+void 			destroy_optregister(optregister_t handle, optregister_cb_t cb);
+
+int 			add_register_opt(optregister_t handle, opt_t opt);
+opt_t 			get_register_opt(optregister_t handle);
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif
diff --git a/src/inc_soq/wired_cfg.h b/src/inc_soq/wired_cfg.h
new file mode 100644
index 0000000..6c4a1c3
--- /dev/null
+++ b/src/inc_soq/wired_cfg.h
@@ -0,0 +1,39 @@
+#ifndef H_WIRED_CFG_H_INCLUDE
+#define H_WIRED_CFG_H_INCLUDE
+#include <stddef.h>
+#ifdef __cplusplus
+extern "C" {
+#endif
+#define	WCFG_RET_ERR		-1
+#define	WCFG_RET_NOT_EXIST	0
+#define	WCFG_RET_OK			1
+
+enum WCFG_OPTION
+{
+	LOCAL_ONLY=0,
+	REMOTE_TIMEOUT,
+	DCFG_ERR
+};
+
+void * wired_cfg_create(const char* app_name, const char* cfg_path);
+
+// return DCFG_RET_xx
+int wired_cfg_set_opt(void*handle, enum WCFG_OPTION option, const char* val, size_t size);
+
+// return DCFG_RET_xx
+int wired_cfg_init(void* handle);
+
+// convert the value as your own wish with sscanf
+// handle		[IN] which aquired by wired_cfg_create
+// section	[IN] section name in initialization file
+// key		[IN] keyword name in initialization file
+// value		[OUT] returned string
+// size		[IN] buffer size(bytes)
+//default_value[IN] default string
+int wired_cfg_read(void*handle, const char* section, const char* key,char* value, size_t size,const char* default_value);
+
+void wired_cfg_destroy(void* handle);
+#ifdef __cplusplus
+}
+#endif
+#endif
diff --git a/src/inc_soq/zd_statistics_log.h b/src/inc_soq/zd_statistics_log.h
new file mode 100644
index 0000000..baaa02f
--- /dev/null
+++ b/src/inc_soq/zd_statistics_log.h
@@ -0,0 +1,44 @@
+#ifndef __ZD_STATISTICS_LOG_H__
+#define	__ZD_STATISTICS_LOG_H__
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+	
+
+/* table_id */
+#define	TABLE_ID_ZD_WARNING_TABLE				1
+#define	TABLE_ID_ZD_XJYSPFWQ_STATISTICS_TABLE	2
+#define	TABLE_ID_ZD_STATISTICS_TABLE			3
+#define	TABLE_ID_ZD_BLOCKLOG_TABLE				4
+
+
+
+typedef struct _log_opt
+{
+	int opt_type;
+	int opt_len;   /* length of opt_value  */
+	const void* opt_value;
+}log_opt_t;
+
+/*
+* arguments:
+ * 	arg1: �����Ӧ��ID
+ *	arg2����־ѡ������
+ *  arg3: ѡ��ĸ���
+ * returns:
+ *    �ɹ�ʱ���ط��ͳ��ȣ�ʧ��ʱ����С��0��ֵ
+ * 	-1, ������־��Ϣʧ��
+ *	-2, ����ʧ��
+ *	-3, ���͵ij��Ⱥ���ʵ���Ȳ����
+ *	-4,ip�����ڻ�portδ����
+*/
+
+unsigned int send_statistics_log(const int table_id, log_opt_t* opt_array, int opt_num);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif
+