summaryrefslogtreecommitdiffstats
path: root/syslogd.c
diff options
context:
space:
mode:
authorRainer Gerhards <rgerhards@adiscon.com>2008-04-11 20:21:02 +0200
committerRainer Gerhards <rgerhards@adiscon.com>2008-04-11 20:21:02 +0200
commit63d4de81ec485425231676d53813ff465249e800 (patch)
tree35092544941853f3c102503e5d691263a3786e9a /syslogd.c
parent890f782323849b2ae01cd705312d54a4a0e348fe (diff)
downloadrsyslog-63d4de81ec485425231676d53813ff465249e800.zip
rsyslog-63d4de81ec485425231676d53813ff465249e800.tar.gz
rsyslog-63d4de81ec485425231676d53813ff465249e800.tar.xz
enhanced legacy syslog parser to handle slightly malformed messages
Those with a space in front of the timestamp - at least HP procurve is known to do that and I won't outrule that others also do it. The change looks quite unintrusive and so we added it to the parser.
Diffstat (limited to 'syslogd.c')
-rw-r--r--syslogd.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/syslogd.c b/syslogd.c
index aee945f..9bd852b 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -1390,11 +1390,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags)
/* Check to see if msg contains a timestamp. We stary trying with a
* high-precision one...
*/
- if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE)
+ if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) {
/* we are done - parse pointer is moved by ParseTIMESTAMP3339 */;
- else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE)
+ } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) {
p2parse += 16;
- else {
+ } else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */
+ if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) {
+ /* indeed, we got it! */
+ p2parse += 17;
+ } else {
+ flags |= ADDDATE;
+ }
+ } else {
flags |= ADDDATE;
}