bugs in syslog parsing

This commit is contained in:
Girish Ramakrishnan
2024-09-10 13:46:13 +02:00
parent 8c0c9981de
commit 86c4db8f22

View File

@@ -18,13 +18,13 @@ let gServer = null;
// https://docs.docker.com/engine/logging/drivers/syslog/
// example: <34>1 2023-09-07T14:33:22Z myhost myapp 1234 5678 [exampleSDID@32473 iut="3" eventSource="Application"] An example message
function parseRFC5424Message(message) {
const syslogRegex = /^<(\d+)>(\d+) (\S+) (\S+) (\S+) (\S+) (\S+) (?:\[(.*?)\])?(.*)$/;
function parseRFC5424Message(rawMessage) {
const syslogRegex = /^<(\d+)>(\d+) (\S+) (\S+) (\S+) (\S+) (\S+) (?:\[(.*?)\])?(.*)$/s; // /s means .* will match newline
const match = message.match(syslogRegex);
const match = rawMessage.match(syslogRegex);
if (!match) return null;
const [, pri, version, timestamp, hostname, appName, procId, msgId, structuredData, msg] = match;
const [, pri, version, timestamp, hostname, appName, procId, msgId, structuredData, message] = match;
return {
pri: parseInt(pri, 10), // priority
@@ -35,7 +35,7 @@ function parseRFC5424Message(message) {
procId, // process ID
msgId, // message ID
structuredData: structuredData ? structuredData : null, // structured data (if present)
msg: msg ? msg.trim() : null // message
message // message
};
}
@@ -51,25 +51,19 @@ async function start() {
});
gServer.on('connection', function (socket) {
socket.on('data', function (msg) {
const lines = msg.toString().split('\n'); // may be multiline data
socket.on('data', function (data) {
const msg = data.toString('utf8');
const info = parseRFC5424Message(msg);
if (!info) return debug('Unable to parse:', msg);
if (!info.appName) return debug('Ignore unknown app:', msg);
for (const msg of lines) {
const info = parseRFC5424Message(msg);
if (!info || !info.appName) return debug('Ignore unknown app log:', msg);
const appLogDir = path.join(paths.LOG_DIR, info.appName);
// remove line breaks to avoid holes in the log file
// we do not ignore empty log lines, to allow gaps for potential ease of readability
const message = info.message.replace(/[\n\r]+/g, '');
const appLogDir = path.join(paths.LOG_DIR, info.appName);
try {
fs.mkdirSync(appLogDir, { recursive: true });
fs.appendFileSync(`${appLogDir}/app.log`, `${info.timestamp} ${message}\n}`);
} catch (error) {
debug(error);
}
try {
fs.mkdirSync(appLogDir, { recursive: true });
fs.appendFileSync(`${appLogDir}/app.log`, `${info.timestamp} ${info.message.trim()}\n`);
} catch (error) {
debug(error);
}
});