improved parser test suite

new tests added, now much better
This commit is contained in:
Rainer Gerhards 2009-04-03 18:20:52 +02:00
parent ce6b7e86cd
commit 04b06af335
7 changed files with 19 additions and 1 deletions

View File

@ -479,7 +479,7 @@ ParseTIMESTAMP3164(struct syslogTime *pTime, char** ppszTS)
if(hour > 1970 && hour < 2100) {
/* if so, we assume this actually is a year. This is a format found
* e.g. in Cisco devices.
* (if you read this 2100+ trying to fix a bug, congratulate myself
* (if you read this 2100+ trying to fix a bug, congratulate me
* to how long the code survived - me no longer ;)) -- rgerhards, 2008-11-18
*/
year = hour;

View File

@ -0,0 +1,3 @@
<38>Mar 27 19:06:53 source_server sshd(pam_unix)[12750]: session opened for user foo by (uid=0)
38,auth,info,Mar 27 19:06:53,source_server,sshd(pam_unix),sshd(pam_unix)[12750]:, session opened for user foo by (uid=0)
# yet another real-life sample where we had some issues with

View File

@ -0,0 +1,3 @@
<38> Mar 7 19:06:53 example tag: testmessage (only date actually tested)
38,auth,info,Mar 7 19:06:53,example,tag,tag:, testmessage (only date actually tested)
# one space in front of the date

View File

@ -0,0 +1,3 @@
<38>Mar 7 19:06:53 example tag: testmessage (only date actually tested)
38,auth,info,Mar 7 19:06:53,example,tag,tag:, testmessage (only date actually tested)
# only one space between "Mar" and "7"

View File

@ -0,0 +1,3 @@
<38>Mar 7 2008 19:06:53: example tag: testmessage (only date actually tested)
38,auth,info,Mar 7 19:06:53,example,tag,tag:, testmessage (only date actually tested)
# the year should not be there, nor the colon after the date, but we accept it...

View File

@ -0,0 +1,3 @@
<38>Mar 7 2008 19:06:53 example tag: testmessage (only date actually tested)
38,auth,info,Mar 7 19:06:53,example,tag,tag:, testmessage (only date actually tested)
# the year should not be there, but we accept it...

View File

@ -0,0 +1,3 @@
<38>Mar 7 19:06:53: example tag: testmessage (only date actually tested)
38,auth,info,Mar 7 19:06:53,example,tag,tag:, testmessage (only date actually tested)
# colon after timestamp is strictly not ok, but we accept it