diff options
-rw-r--r-- | ChangeLog | 4 | ||||
-rw-r--r-- | syslogd.c | 13 |
2 files changed, 14 insertions, 3 deletions
@@ -8,6 +8,10 @@ Version 3.17.1 (rgerhards), 2008-04-?? RFC's on hostname length at all. The memory consumption is no issue, as there are only a handful of this buffers allocated *per run* -- that's also the main reason why we consider it not worth to be fixed any further. +- enhanced legacy syslog parser to handle slightly malformed messages + (with a space in front of the timestamp) - at least HP procurve is + known to do that and I won't outrule that others also do it. The + change looks quite unintrusive and so we added it to the parser. --------------------------------------------------------------------------- Version 3.17.0 (rgerhards), 2008-04-08 - added native ability to send mail messages @@ -1390,11 +1390,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags) /* Check to see if msg contains a timestamp. We stary trying with a * high-precision one... */ - if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) + if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { /* we are done - parse pointer is moved by ParseTIMESTAMP3339 */; - else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) + } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) { p2parse += 16; - else { + } else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */ + if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) { + /* indeed, we got it! */ + p2parse += 17; + } else { + flags |= ADDDATE; + } + } else { flags |= ADDDATE; } |