From 93f49396c3cb1d95e64f18807c85e636aadb2cdc Mon Sep 17 00:00:00 2001
From: Andre Lorbach <alorbach@adiscon.com>
Date: Mon, 8 Sep 2008 12:35:07 +0200
Subject: [PATCH 1/2] Fixed logline parsing of syslog files, which is used by
 the logstream disk class

---
 src/classes/logstreamlineparsersyslog.class.php | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/classes/logstreamlineparsersyslog.class.php b/src/classes/logstreamlineparsersyslog.class.php
index 275e069..c5a90be 100644
--- a/src/classes/logstreamlineparsersyslog.class.php
+++ b/src/classes/logstreamlineparsersyslog.class.php
@@ -73,7 +73,7 @@ class LogStreamLineParsersyslog extends LogStreamLineParser {
 			$arrArguments[SYSLOG_PROCESSID] = $out[5];
 			$arrArguments[SYSLOG_MESSAGE] = $out[6];
 		}
-		// Sample (Syslog): Mar 10 14:45:39 debandre syslogd 1.4.1#18: restart. ([A-Za-z0-9_\/]{1,32})
+		// Sample (Syslog): Mar 10 14:45:39 debandre syslogd 1.4.1#18: restart
 		else if ( preg_match("/(...)(?:.|..)([0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) ([a-zA-Z0-9_\-\.]{1,256}) ([A-Za-z0-9_\-\/\.]{1,32}):(.*?)$/", $szLine, $out ) )
 		{
 			// Copy parsed properties!
@@ -82,6 +82,15 @@ class LogStreamLineParsersyslog extends LogStreamLineParser {
 			$arrArguments[SYSLOG_SYSLOGTAG] = $out[4];
 			$arrArguments[SYSLOG_MESSAGE] = $out[5];
 		}
+		// Sample (Syslog): Mar 10 14:45:39 debandre syslogd restart
+		else if ( preg_match("/(...)(?:.|..)([0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) ([a-zA-Z0-9_\-\.]{1,256}) ([A-Za-z0-9_\-\/\.]{1,32}) (.*?)$/", $szLine, $out ) )
+		{
+			// Copy parsed properties!
+			$arrArguments[SYSLOG_DATE] = GetEventTime($out[1] . " " . $out[2]);
+			$arrArguments[SYSLOG_HOST] = $out[3];
+			$arrArguments[SYSLOG_SYSLOGTAG] = $out[4];
+			$arrArguments[SYSLOG_MESSAGE] = $out[5];
+		}
 		// Sample (Syslog): Mar 7 17:18:35 debandre exiting on signal 15
 		else if ( preg_match("/(...)(?:.|..)([0-9]{1,2} [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}) (.*?) (.*?)$/", $szLine, $out ) )
 		{

From b115b472a6513bb1ba8430883c7bbfecbf5688ca Mon Sep 17 00:00:00 2001
From: Andre Lorbach <alorbach@adiscon.com>
Date: Mon, 8 Sep 2008 12:37:28 +0200
Subject: [PATCH 2/2] Added changelog entry

---
 ChangeLog                        | 5 +++++
 src/include/functions_common.php | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 51faf08..5628f2e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,9 @@
 ---------------------------------------------------------------------------
+Version 2.3.11 (beta), 2008-09-08
+- Fix another parsing issue in the logline parser. Most of RFC 3164
+  formatted syslog messages should now be correctly splitted into their
+  fields. 
+---------------------------------------------------------------------------
 Version 2.3.10 (beta), 2008-08-27
 - Fixed a few parsing issues with prior RFC 3164 syslog messages. 
   These messages are now correctly parsed, or better do not cause
diff --git a/src/include/functions_common.php b/src/include/functions_common.php
index 73f594d..39e1c71 100644
--- a/src/include/functions_common.php
+++ b/src/include/functions_common.php
@@ -62,7 +62,7 @@ $LANG_EN = "en";	// Used for fallback
 $LANG = "en";		// Default language
 
 // Default Template vars
-$content['BUILDNUMBER'] = "2.3.10";
+$content['BUILDNUMBER'] = "2.3.11";
 $content['TITLE'] = "phpLogCon :: Release " . $content['BUILDNUMBER'];	// Default page title 
 $content['BASEPATH'] = $gl_root_path;
 $content['EXTRA_METATAGS'] = "";