0ct0pu5/crowdsec
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix #1170 : display full message in debug mode when syslog cannot parse (#1176)

Browse source 
* fix #1170 : display full message in debug mode when syslog cannot parse
This commit is contained in:
Thibault "bui" Koechlin 2022-01-18 09:54:01 +01:00 • committed by GitHub
parent 9d133ea2b5
commit a17f150e5d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
pkg/acquisition/modules/syslog/syslog.go
View file

@ -202,16 +202,18 @@ func (s *SyslogSource) handleSyslogMsg(out chan types.Event, t *tomb.Tomb, c cha
p := rfc5424.NewParser()
m, err := p.Parse(syslogLine.Message)
if err != nil {
logger.Debugf("could not parse message as RFC5424, falling back to RFC3164 : %s", err)
logger.Debugf("could not parse as RFC5424 (%s)", err)
p = rfc3164.NewParser(rfc3164.WithYear(rfc3164.CurrentYear{}))
m, err = p.Parse(syslogLine.Message)
if err != nil {
logger.Errorf("could not parse message: %s", err)
logger.Debugf("could not parse as RFC3164 (%s) : %s", err, syslogLine.Message)
continue
}
msg := m.(*rfc3164.SyslogMessage)
line, err = s.buildLogFromSyslog(msg.Timestamp, msg.Hostname, msg.Appname, msg.ProcID, msg.Message)
if err != nil {
logger.Debugf("could not parse as RFC3164 (%s) : %s", err, syslogLine.Message)
logger.Error(err)
continue
}
@ -221,6 +223,7 @@ func (s *SyslogSource) handleSyslogMsg(out chan types.Event, t *tomb.Tomb, c cha
msg := m.(*rfc5424.SyslogMessage)
line, err = s.buildLogFromSyslog(msg.Timestamp, msg.Hostname, msg.Appname, msg.ProcID, msg.Message)
if err != nil {
log.Debugf("could not parse message as RFC5424 (%s) : %s", err, syslogLine.Message)
logger.Error(err)
continue
}