added new property replacer option "date-rfc3164-buggyday"

primarily to ease migration from syslog-ng. See property replacer doc
for details.

11 files changed, 53 insertions, 8 deletions

diff --git a/ChangeLog b/ChangeLog
index 80336814..a1dbabb1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 ---------------------------------------------------------------------------
 Version 5.5.3  [DEVEL] (rgerhards), 2010-02-??
+- added new property replacer option "date-rfc3164-buggyday" primarily
+  to ease migration from syslog-ng. See property replacer doc for
+  details.
 - added capability to turn off standard LF delimiter in TCP server
   via new directive "$InputTCPServerDisableLFDelimiter on"
 - bugfix: failed to compile on systems without epoll support
diff --git a/doc/property_replacer.html b/doc/property_replacer.html
index 7b604ea0..390fc0d0 100644
--- a/doc/property_replacer.html
+++ b/doc/property_replacer.html
@@ -335,6 +335,18 @@ Especially useful for PIX.</td>
 <td>format as RFC 3164 date</td>
 </tr>
 <tr>
+<tr>
+<td valign="top"><b>date-rfc3164-buggyday</b></td>
+<td>similar to date-rfc3164, but emulates a common coding error: RFC 3164 demands
+that a space is written for single-digit days. With this option, a zero is
+written instead. This format seems to be used by syslog-ng and the
+date-rfc3164-buggyday option can be used in migration scenarios where otherwise
+lots of scripts would need to be adjusted. It is recommended <i>not</i> to use this
+option when forwarding to remote hosts - they may treat the date as invalid
+(especially when parsing strictly according to RFC 3164).</td>
+<br><i>This feature was introduced in rsyslog 5.5.3.</i>
+</tr>
+<tr>
 <td><b>date-rfc3339</b></td>
 <td>format as RFC 3339 date</td>
 </tr>
diff --git a/runtime/datetime.c b/runtime/datetime.c
index 47d7ac0e..de26762d 100644
--- a/runtime/datetime.c
+++ b/runtime/datetime.c
@@ -811,8 +811,12 @@ int formatTimestamp3339(struct syslogTime *ts, char* pBuf)
  * buffer that will receive the resulting string. The function
  * returns the size of the timestamp written in bytes (without
  * the string termnator). If 0 is returend, an error occured.
+ * rgerhards, 2010-03-05: Added support to for buggy 3164 dates,
+ * where a zero-digit is written instead of a space for the first
+ * day character if day < 10. syslog-ng seems to do that, and some
+ * parsing scripts (in migration cases) rely on that.
  */
-int formatTimestamp3164(struct syslogTime *ts, char* pBuf)
+int formatTimestamp3164(struct syslogTime *ts, char* pBuf, int bBuggyDay)
 {
 	static char* monthNames[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
 					"Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
@@ -825,7 +829,7 @@ int formatTimestamp3164(struct syslogTime *ts, char* pBuf)
 	pBuf[2] = monthNames[(ts->month - 1) % 12][2];
 	pBuf[3] = ' ';
 	iDay = (ts->day / 10) % 10; /* we need to write a space if the first digit is 0 */
-	pBuf[4] = iDay ? iDay + '0' : ' ';
+	pBuf[4] = (bBuggyDay || iDay > 0) ? iDay + '0' : ' ';
 	pBuf[5] = ts->day % 10 + '0';
 	pBuf[6] = ' ';
 	pBuf[7] = (ts->hour / 10) % 10 + '0';
diff --git a/runtime/datetime.h b/runtime/datetime.h
index 1de3db95..647f3096 100644
--- a/runtime/datetime.h
+++ b/runtime/datetime.h
@@ -39,12 +39,12 @@ BEGINinterface(datetime) /* name must also be changed in ENDinterface macro! */
 	int (*formatTimestampToMySQL)(struct syslogTime *ts, char* pDst);
 	int (*formatTimestampToPgSQL)(struct syslogTime *ts, char *pDst);
 	int (*formatTimestamp3339)(struct syslogTime *ts, char* pBuf);
-	int (*formatTimestamp3164)(struct syslogTime *ts, char* pBuf);
+	int (*formatTimestamp3164)(struct syslogTime *ts, char* pBuf, int);
 	int (*formatTimestampSecFrac)(struct syslogTime *ts, char* pBuf);
 	/* v3, 2009-11-12 */
 	time_t (*GetTime)(time_t *ttSeconds);
 ENDinterface(datetime)
-#define datetimeCURR_IF_VERSION 3 /* increment whenever you change the interface structure! */
+#define datetimeCURR_IF_VERSION 4 /* increment whenever you change the interface structure! */
 /* interface changes:
  * 1 - initial version
  * 2 - not compatible to 1 - bugfix required ParseTIMESTAMP3164 to accept char ** as
diff --git a/runtime/msg.c b/runtime/msg.c
index 629c6f24..ab0e45ba 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -1272,10 +1272,12 @@ static inline char *getTimeReported(msg_t *pM, enum tplFormatTypes eFmt)
 	switch(eFmt) {
 	case tplFmtDefault:
 	case tplFmtRFC3164Date:
+	case tplFmtRFC3164BuggyDate:
 		MsgLock(pM);
 		if(pM->pszTIMESTAMP3164 == NULL) {
 			pM->pszTIMESTAMP3164 = pM->pszTimestamp3164;
-			datetime.formatTimestamp3164(&pM->tTIMESTAMP, pM->pszTIMESTAMP3164);
+			datetime.formatTimestamp3164(&pM->tTIMESTAMP, pM->pszTIMESTAMP3164,
+						     (eFmt == tplFmtRFC3164BuggyDate));
 		}
 		MsgUnlock(pM);
 		return(pM->pszTIMESTAMP3164);
@@ -1338,7 +1340,7 @@ static inline char *getTimeGenerated(msg_t *pM, enum tplFormatTypes eFmt)
 				MsgUnlock(pM);
 				return "";
 			}
-			datetime.formatTimestamp3164(&pM->tRcvdAt, pM->pszRcvdAt3164);
+			datetime.formatTimestamp3164(&pM->tRcvdAt, pM->pszRcvdAt3164, 0);
 		}
 		MsgUnlock(pM);
 		return(pM->pszRcvdAt3164);
@@ -1365,13 +1367,15 @@ static inline char *getTimeGenerated(msg_t *pM, enum tplFormatTypes eFmt)
                 MsgUnlock(pM);
                 return(pM->pszRcvdAt_PgSQL);
 	case tplFmtRFC3164Date:
+	case tplFmtRFC3164BuggyDate:
 		MsgLock(pM);
 		if(pM->pszRcvdAt3164 == NULL) {
 			if((pM->pszRcvdAt3164 = MALLOC(16)) == NULL) {
 					MsgUnlock(pM);
 					return "";
 				}
-			datetime.formatTimestamp3164(&pM->tRcvdAt, pM->pszRcvdAt3164);
+			datetime.formatTimestamp3164(&pM->tRcvdAt, pM->pszRcvdAt3164,
+						     (eFmt == tplFmtRFC3164BuggyDate));
 		}
 		MsgUnlock(pM);
 		return(pM->pszRcvdAt3164);
diff --git a/template.c b/template.c
index d74da475..050905b0 100644
--- a/template.c
+++ b/template.c
@@ -487,6 +487,8 @@ static void doOptions(unsigned char **pp, struct templateEntry *pTpe)
                         pTpe->data.field.eDateFormat = tplFmtPgSQLDate;
 		 } else if(!strcmp((char*)Buf, "date-rfc3164")) {
 			pTpe->data.field.eDateFormat = tplFmtRFC3164Date;
+		 } else if(!strcmp((char*)Buf, "date-rfc3164-buggyday")) {
+			pTpe->data.field.eDateFormat = tplFmtRFC3164BuggyDate;
 		 } else if(!strcmp((char*)Buf, "date-rfc3339")) {
 			pTpe->data.field.eDateFormat = tplFmtRFC3339Date;
 		 } else if(!strcmp((char*)Buf, "date-subseconds")) {
diff --git a/template.h b/template.h
index 271e8271..71e8b428 100644
--- a/template.h
+++ b/template.h
@@ -48,7 +48,7 @@ struct template {
 enum EntryTypes { UNDEFINED = 0, CONSTANT = 1, FIELD = 2 };
 enum tplFormatTypes { tplFmtDefault = 0, tplFmtMySQLDate = 1,
                       tplFmtRFC3164Date = 2, tplFmtRFC3339Date = 3, tplFmtPgSQLDate = 4,
-		      tplFmtSecFrac = 5};
+		      tplFmtSecFrac = 5, tplFmtRFC3164BuggyDate = 6};
 enum tplFormatCaseConvTypes { tplCaseConvNo = 0, tplCaseConvUpper = 1, tplCaseConvLower = 2 };
 
 #include "msg.h"
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 63dba939..32388d78 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -128,6 +128,8 @@ EXTRA_DIST= 1.rstest 2.rstest 3.rstest err1.rstest \
 	   testsuites/reallife.parse3 \
 	   testsuites/parse_invld_regex.conf \
 	   testsuites/samples.parse_invld_regex \
+	   testsuites/parse-3164-buggyday.conf \
+	   testsuites/samples.parse-3164-buggyday \
 	   testsuites/omod-if-array.conf \
 	   testsuites/1.omod-if-array \
 	   testsuites/1.field1 \
diff --git a/tests/parsertest.sh b/tests/parsertest.sh
index 06fcc8d6..cf975a77 100755
--- a/tests/parsertest.sh
+++ b/tests/parsertest.sh
@@ -10,6 +10,8 @@ source $srcdir/diag.sh nettester parse3 udp
 source $srcdir/diag.sh nettester parse3 tcp
 source $srcdir/diag.sh nettester parse_invld_regex udp
 source $srcdir/diag.sh nettester parse_invld_regex tcp
+source $srcdir/diag.sh nettester parse-3164-buggyday udp
+source $srcdir/diag.sh nettester parse-3164-buggyday tcp
 
 echo \[parsertest.sh]: redoing tests in IPv4-only mode
 source $srcdir/diag.sh nettester parse1 udp -4
@@ -22,4 +24,6 @@ source $srcdir/diag.sh nettester parse3 udp -4
 source $srcdir/diag.sh nettester parse3 tcp -4
 source $srcdir/diag.sh nettester parse_invld_regex udp -4
 source $srcdir/diag.sh nettester parse_invld_regex tcp -4
+source $srcdir/diag.sh nettester parse-3164-buggyday udp -4
+source $srcdir/diag.sh nettester parse-3164-buggyday tcp -4
 source $srcdir/diag.sh exit
diff --git a/tests/testsuites/parse-3164-buggyday.conf b/tests/testsuites/parse-3164-buggyday.conf
new file mode 100644
index 00000000..937f423a
--- /dev/null
+++ b/tests/testsuites/parse-3164-buggyday.conf
@@ -0,0 +1,8 @@
+$ModLoad ../plugins/omstdout/.libs/omstdout
+$IncludeConfig nettest.input.conf	# This picks the to be tested input from the test driver!
+
+$ErrorMessagesToStderr off
+
+# use a special format that we can easily parse in expect
+$template expect,"%PRI%,%syslogfacility-text%,%syslogseverity-text%,%timestamp:::date-rfc3164-buggyday%,%hostname%,%programname%,%syslogtag%,%msg%\n"
+*.* :omstdout:;expect
diff --git a/tests/testsuites/samples.parse-3164-buggyday b/tests/testsuites/samples.parse-3164-buggyday
new file mode 100644
index 00000000..e21df980
--- /dev/null
+++ b/tests/testsuites/samples.parse-3164-buggyday
@@ -0,0 +1,6 @@
+# in 3164-buggyday mode, we need to have a leading zero in front of the day
+<38> Mar  7 19:06:53 example tag: testmessage (only date actually tested)
+38,auth,info,Mar 07 19:06:53,example,tag,tag:, testmessage (only date actually tested)
+# and now one with a complete date:
+<38> Mar 17 19:06:53 example tag: testmessage (only date actually tested)
+38,auth,info,Mar 17 19:06:53,example,tag,tag:, testmessage (only date actually tested)