rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2025-12-18 15:40:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

enhanced legacy syslog parser to handle slightly malformed messages

Browse Source 
Those with a space in front of the timestamp - at least HP procurve is
known to do that and I won't outrule that others also do it. The
change looks quite unintrusive and so we added it to the parser.
This commit is contained in:
Rainer Gerhards 2008-04-11 20:21:02 +02:00
parent 890f782323
commit 63d4de81ec
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -8,6 +8,10 @@ Version 3.17.1 (rgerhards), 2008-04-??
RFC's on hostname length at all. The memory consumption is no issue, as
there are only a handful of this buffers allocated *per run* -- that's
also the main reason why we consider it not worth to be fixed any further.
- enhanced legacy syslog parser to handle slightly malformed messages
(with a space in front of the timestamp) - at least HP procurve is
known to do that and I won't outrule that others also do it. The
change looks quite unintrusive and so we added it to the parser.
---------------------------------------------------------------------------
Version 3.17.0 (rgerhards), 2008-04-08
- added native ability to send mail messages

13
syslogd.c
View File

@ -1390,11 +1390,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags)
/* Check to see if msg contains a timestamp. We stary trying with a
* high-precision one...
*/
if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE)
if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) {
/* we are done - parse pointer is moved by ParseTIMESTAMP3339 */;
else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE)
} else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) {
p2parse += 16;
else {
} else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */
if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) {
/* indeed, we got it! */
p2parse += 17;
} else {
flags |= ADDDATE;
}
} else {
flags |= ADDDATE;
}