diff --git a/ChangeLog b/ChangeLog index 42404cc..ece965c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,9 @@ --------------------------------------------------------------------------- +Version 2.3.11 (beta), 2008-09-08 +- Fix another parsing issue in the logline parser. Most of RFC 3164 + formatted syslog messages should now be correctly splitted into their + fields. +--------------------------------------------------------------------------- Version 2.5.6 (devel), 2008-09-03 - Implemented Message Parser facility. This new extendable facility of phpLogCon helps splitting messages into fields. And the fields can diff --git a/src/classes/logstreamlineparsersyslog.class.php b/src/classes/logstreamlineparsersyslog.class.php index 8827da3..7a3fead 100644 --- a/src/classes/logstreamlineparsersyslog.class.php +++ b/src/classes/logstreamlineparsersyslog.class.php @@ -73,7 +73,7 @@ class LogStreamLineParsersyslog extends LogStreamLineParser { $arrArguments[SYSLOG_PROCESSID] = $out[5]; $arrArguments[SYSLOG_MESSAGE] = $out[6]; } - // Sample (Syslog): Mar 10 14:45:39 debandre syslogd 1.4.1#18: restart. ([A-Za-z0-9_\/]{1,32}) + // Sample (Syslog): Mar 10 14:45:39 debandre syslogd 1.4.1#18: restart else if ( preg_match("/(...)(?:.|..)([0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) ([a-zA-Z0-9_\-\.]{1,256}) ([A-Za-z0-9_\-\/\.]{1,32}):(.*?)$/", $szLine, $out ) ) { // Copy parsed properties! @@ -82,6 +82,15 @@ class LogStreamLineParsersyslog extends LogStreamLineParser { $arrArguments[SYSLOG_SYSLOGTAG] = $out[4]; $arrArguments[SYSLOG_MESSAGE] = $out[5]; } + // Sample (Syslog): Mar 10 14:45:39 debandre syslogd restart + else if ( preg_match("/(...)(?:.|..)([0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) ([a-zA-Z0-9_\-\.]{1,256}) ([A-Za-z0-9_\-\/\.]{1,32}) (.*?)$/", $szLine, $out ) ) + { + // Copy parsed properties! + $arrArguments[SYSLOG_DATE] = GetEventTime($out[1] . " " . $out[2]); + $arrArguments[SYSLOG_HOST] = $out[3]; + $arrArguments[SYSLOG_SYSLOGTAG] = $out[4]; + $arrArguments[SYSLOG_MESSAGE] = $out[5]; + } // Sample (Syslog): Mar 7 17:18:35 debandre exiting on signal 15 else if ( preg_match("/(...)(?:.|..)([0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) (.*?) (.*?)$/", $szLine, $out ) ) {