| line |
stmt |
bran |
cond |
sub |
pod |
time |
code |
|
1
|
|
|
|
|
|
|
# $Id: Syslog.pm 579 2005-11-20 22:52:26Z sungo $ |
|
2
|
|
|
|
|
|
|
package POE::Filter::Syslog; |
|
3
|
|
|
|
|
|
|
|
|
4
|
8
|
|
|
8
|
|
253142
|
use warnings; |
|
|
8
|
|
|
|
|
19
|
|
|
|
8
|
|
|
|
|
280
|
|
|
5
|
8
|
|
|
8
|
|
47
|
use strict; |
|
|
8
|
|
|
|
|
17
|
|
|
|
8
|
|
|
|
|
264
|
|
|
6
|
|
|
|
|
|
|
|
|
7
|
8
|
|
|
8
|
|
1856
|
use POE; |
|
|
8
|
|
|
|
|
181889
|
|
|
|
8
|
|
|
|
|
57
|
|
|
8
|
8
|
|
|
8
|
|
346325
|
use Time::ParseDate; |
|
|
8
|
|
|
|
|
173120
|
|
|
|
8
|
|
|
|
|
5031
|
|
|
9
|
|
|
|
|
|
|
|
|
10
|
|
|
|
|
|
|
our $VERSION = '1.20'; |
|
11
|
|
|
|
|
|
|
|
|
12
|
|
|
|
|
|
|
our $SYSLOG_REGEXP = q| |
|
13
|
|
|
|
|
|
|
^<(\d+)> # priority -- 1 |
|
14
|
|
|
|
|
|
|
(?: |
|
15
|
|
|
|
|
|
|
(\S{3})\s+(\d+) # month day -- 2, 3 |
|
16
|
|
|
|
|
|
|
\s |
|
17
|
|
|
|
|
|
|
(\d+):(\d+):(\d+) # time -- 4, 5, 6 |
|
18
|
|
|
|
|
|
|
)? |
|
19
|
|
|
|
|
|
|
\s* |
|
20
|
|
|
|
|
|
|
(.*) # text -- 7 |
|
21
|
|
|
|
|
|
|
$ |
|
22
|
|
|
|
|
|
|
|; |
|
23
|
|
|
|
|
|
|
|
|
24
|
|
|
|
|
|
|
sub new { |
|
25
|
10
|
|
|
10
|
1
|
160
|
return bless { |
|
26
|
|
|
|
|
|
|
buffer => '', |
|
27
|
|
|
|
|
|
|
}, shift; |
|
28
|
|
|
|
|
|
|
} |
|
29
|
|
|
|
|
|
|
|
|
30
|
|
|
|
|
|
|
sub get_one_start { |
|
31
|
6
|
|
|
6
|
1
|
665
|
my $self = shift; |
|
32
|
6
|
|
|
|
|
40
|
my $input = shift; |
|
33
|
6
|
|
|
|
|
75
|
$self->{buffer} .= join("",@$input); |
|
34
|
|
|
|
|
|
|
} |
|
35
|
|
|
|
|
|
|
|
|
36
|
|
|
|
|
|
|
sub get { |
|
37
|
5
|
|
|
5
|
1
|
6039
|
my $self = shift; |
|
38
|
5
|
|
|
|
|
7
|
my $incoming = shift; |
|
39
|
5
|
50
|
33
|
|
|
35
|
return [] unless $incoming and @$incoming; |
|
40
|
5
|
|
|
|
|
14
|
my $stream = join ("", @$incoming); |
|
41
|
|
|
|
|
|
|
|
|
42
|
5
|
|
|
|
|
6
|
my @found; |
|
43
|
5
|
50
|
33
|
|
|
26
|
if($stream and length $stream) { |
|
44
|
|
|
|
|
|
|
|
|
45
|
5
|
|
|
|
|
80
|
while ( $stream =~ s/$SYSLOG_REGEXP//sx ) { |
|
46
|
4
|
|
66
|
|
|
40
|
my $time = $2 && parsedate("$2 $3 $4:$5:$6"); |
|
47
|
4
|
|
66
|
|
|
2985
|
$time ||= time(); |
|
48
|
|
|
|
|
|
|
|
|
49
|
4
|
|
|
|
|
37
|
my $msg = { |
|
50
|
|
|
|
|
|
|
time => $time, |
|
51
|
|
|
|
|
|
|
pri => $1, |
|
52
|
|
|
|
|
|
|
facility => int($1/8), |
|
53
|
|
|
|
|
|
|
severity => int($1%8), |
|
54
|
|
|
|
|
|
|
msg => $7, |
|
55
|
|
|
|
|
|
|
}; |
|
56
|
4
|
|
|
|
|
17
|
push @found, $msg; |
|
57
|
|
|
|
|
|
|
} |
|
58
|
|
|
|
|
|
|
} |
|
59
|
5
|
|
|
|
|
16
|
return \@found; |
|
60
|
|
|
|
|
|
|
} |
|
61
|
|
|
|
|
|
|
|
|
62
|
|
|
|
|
|
|
|
|
63
|
|
|
|
|
|
|
sub get_one { |
|
64
|
12
|
|
|
12
|
1
|
181
|
my $self = shift; |
|
65
|
12
|
|
|
|
|
34
|
my $found = 0; |
|
66
|
12
|
100
|
66
|
|
|
149
|
if($self->{buffer} and length $self->{buffer}) { |
|
67
|
6
|
50
|
|
|
|
334
|
if ( $self->{buffer} =~ s/$SYSLOG_REGEXP//sx ) { |
|
68
|
6
|
|
33
|
|
|
123
|
my $time = $2 && parsedate("$2 $3 $4:$5:$6"); |
|
69
|
6
|
|
|
|
|
9015
|
my $msg = { |
|
70
|
|
|
|
|
|
|
time => $time, |
|
71
|
|
|
|
|
|
|
pri => $1, |
|
72
|
|
|
|
|
|
|
facility => int($1/8), |
|
73
|
|
|
|
|
|
|
severity => int($1%8), |
|
74
|
|
|
|
|
|
|
msg => $7, |
|
75
|
|
|
|
|
|
|
}; |
|
76
|
6
|
|
|
|
|
17
|
$found = $msg; |
|
77
|
|
|
|
|
|
|
} |
|
78
|
|
|
|
|
|
|
} |
|
79
|
12
|
100
|
|
|
|
47
|
if($found) { |
|
80
|
6
|
|
|
|
|
54
|
return [ $found ]; |
|
81
|
|
|
|
|
|
|
} else { |
|
82
|
6
|
|
|
|
|
45
|
return []; |
|
83
|
|
|
|
|
|
|
} |
|
84
|
|
|
|
|
|
|
} |
|
85
|
|
|
|
|
|
|
|
|
86
|
0
|
|
|
0
|
1
|
|
sub put {} # XXX |
|
87
|
|
|
|
|
|
|
|
|
88
|
|
|
|
|
|
|
1; |
|
89
|
|
|
|
|
|
|
__END__ |