0ct0pu5/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Extra syslog debug (#1030)

Browse source 
* extra logging
This commit is contained in:
Thibault "bui" Koechlin 2021-11-01 20:55:03 +01:00 • committed by GitHub
parent 02886140a7
commit 2b2a11fec7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
pkg/acquisition/modules/syslog/internal/syslogserver.go
View file

@ -37,6 +37,7 @@ func (s *SyslogServer) Listen(listenAddr string, port int) error {
if err != nil {
return errors.Wrapf(err, "could not listen on port %d", s.port)
}
s.Logger.Debugf("listening on %s:%d", s.listenAddr, s.port)
s.udpConn = udpConn
err = s.udpConn.SetReadBuffer(s.MaxMessageLen) // FIXME probably
if err != nil {

8
pkg/acquisition/modules/syslog/syslog.go
View file

@ -136,14 +136,19 @@ func (s *SyslogSource) StreamingAcquisition(out chan types.Event, t *tomb.Tomb)
func (s *SyslogSource) buildLogFromSyslog(ts *time.Time, hostname *string,
appname *string, pid *string, msg *string) (string, error) {
ret := ""
if msg == nil {
return "", errors.Errorf("missing message field in syslog message")
}
if ts != nil {
ret += ts.Format("Jan 2 15:04:05")
} else {
s.logger.Tracef("%s - missing TS", *msg)
ret += time.Now().Format("Jan 2 15:04:05")
}
if hostname != nil {
ret += " " + *hostname
} else {
s.logger.Tracef("%s - missing host", *msg)
ret += " unknownhost"
}
if appname != nil {
@ -169,8 +174,6 @@ func (s *SyslogSource) buildLogFromSyslog(ts *time.Time, hostname *string,
}
if msg != nil {
ret += *msg
} else {
return "", errors.Errorf("missing message field in syslog message")
}
return ret, nil
@ -194,6 +197,7 @@ func (s *SyslogSource) handleSyslogMsg(out chan types.Event, t *tomb.Tomb, c cha
var ts time.Time
logger := s.logger.WithField("client", syslogLine.Client)
logger.Tracef("raw: %s", syslogLine)
linesReceived.With(prometheus.Labels{"source": syslogLine.Client}).Inc()
p := rfc5424.NewParser()
m, err := p.Parse(syslogLine.Message)