enhanced legacy syslog parser to handle slightly malformed messages

Those with a space in front of the timestamp - at least HP procurve is
known to do that and I won't outrule that others also do it. The
change looks quite unintrusive and so we added it to the parser.

2 files changed, 14 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 551b7278..7f181ce2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,10 @@ Version 3.17.1 (rgerhards), 2008-04-??
   RFC's on hostname length at all. The memory consumption is no issue, as
   there are only a handful of this buffers allocated *per run* -- that's
   also the main reason why we consider it not worth to be fixed any further.
+- enhanced legacy syslog parser to handle slightly malformed messages
+  (with a space in front of the timestamp) - at least HP procurve is
+  known to do that and I won't outrule that others also do it. The 
+  change looks quite unintrusive and so we added it to the parser.
 ---------------------------------------------------------------------------
 Version 3.17.0 (rgerhards), 2008-04-08
 - added native ability to send mail messages
diff --git a/syslogd.c b/syslogd.c
index aee945f5..9bd852bb 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -1390,11 +1390,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags)
 	/* Check to see if msg contains a timestamp. We stary trying with a
 	 * high-precision one...
 	 */
-	if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE)
+	if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) {
 		/* we are done - parse pointer is moved by ParseTIMESTAMP3339 */;
-	else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE)
+	} else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) {
 		p2parse += 16;
-	else {
+	} else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */
+		if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) {
+			/* indeed, we got it! */
+			p2parse += 17;
+		} else {
+			flags |= ADDDATE;
+		}
+	} else {
 		flags |= ADDDATE;
 	}