1

"""

     2

    Log messages (e.g. syslog)

     3

"""

     4

     5

# stdlib syslog, for facilities and levels

     6

import syslog

     7

import time, datetime

     8

import re

    10

    11

PRIORITY_NAMES = {

    12

    syslog.LOG_EMERG:       'emerg',

    13

    syslog.LOG_ALERT:       'alert', 

    14

    syslog.LOG_CRIT:        'crit', 

    15

    syslog.LOG_ERR:         'err',

    16

    syslog.LOG_WARNING:     'warning',

    17

    syslog.LOG_NOTICE:      'notice',

    18

    syslog.LOG_INFO:        'info', 

    19

    syslog.LOG_DEBUG:       'debug',

    20

}

    21

    22

FACILITY_NAMES = {

    23

    syslog.LOG_KERN:	'kern',     # 0

    24

    syslog.LOG_USER:	'user',     # 1

    25

    syslog.LOG_MAIL:	'mail',     # 2

    26

    syslog.LOG_DAEMON:	'daemon',   # 3

    27

    syslog.LOG_AUTH:	'auth',     # 4

    28

    5:                  'syslog',   # 5

    29

    syslog.LOG_LPR:	    'lpr',      # 6

    30

    syslog.LOG_NEWS:	'news',     # 7

    31

    syslog.LOG_UUCP:	'uucp',     # 8

    32

    syslog.LOG_CRON:	'cron',     # 9

    33

    10:                 'authpriv', # 10

    34

    11:                 'ftp',      # 11

    35

    12:                 'ntp',      # 12

    36

    13:                 'audit',    # 13

    37

    14:                 'alert',    # 14

    38

    15:                 'clock',    # 15

    39

    syslog.LOG_LOCAL0:	'local0',   # 16

    40

    syslog.LOG_LOCAL1:	'local1',   # 17

    41

    syslog.LOG_LOCAL2:	'local2',   # 18

    42

    syslog.LOG_LOCAL3:	'local3',   # 19

    43

    syslog.LOG_LOCAL4:	'local4',   # 20

    44

    syslog.LOG_LOCAL5:	'local5',   # 21

    45

    syslog.LOG_LOCAL6:	'local6',   # 22

    46

    syslog.LOG_LOCAL7:	'local7',   # 23

    47

}

    48

    49

class SyslogMessage (object) :

    50

    """

    51

        A message from syslog with the following fields:

    52

    53

            pri             - (optional) raw integer priority field

    54

            priority        - (optional) message priority as text

    55

            facility        - (optional) message facility as text

    56

            timestamp       - message timestamp as a datetime

    57

            hostname        - originating hostname

    58

            tag             - (optional) message tag including process name and id

    59

            program         - (optional) process name part of message tag

    60

            pid             - (optional) process ID part of message tag

    61

            text            - the log message following the tag

    62

            message         - the full log message including the tag

    63

            raw             - the full syslog-format message

    64

    """

    65

    66

    # the regular expression used to parse the lines

    67

    LINE_RE = re.compile(

    68

            # the priority field as in raw syslog messages

    69

            r"(?:<(?P<pri>\d+)>)?"

    70

    71

            # the timestamp+hostname header

    72

        +   r"(?P<timestamp>\w{3} [0-9 ]\d \d{2}:\d{2}:\d{2}) (?P<hostname>\S+)"

    73

    74

            # the message, including possible tag/pid

    75

        +   r" (?P<message>(?P<tag>(?P<program>[^:\]]+)(?:\[(?P<pid>\d+)\])?: )?(?P<text>.*))\n?"

    76

    )

    77

    78

    # strptime format of timestamp

    79

    TIMESTAMP_FMT = "%b %d %H:%M:%S"

    80

    81

    def _parse_pri (self, match) :

    82

        """

    83

            Parse the priority/facility from the given match object

    84

        """

    85

    86

        # raw integer

    87

        self.pri = int(match.group('pri')) if match.group('pri') else None

    88

    89

        if self.pri :

    90

            # unpack

    91

            priority = self.pri % 8

    92

            facility = self.pri // 8

    93

    94

            # translate to names

    95

            self.priority = PRIORITY_NAMES.get(priority, str(priority))

    96

            self.facility = FACILITY_NAMES.get(facility, str(facility))

    97

    98

        else :

    99

            self.priority = self.facility = None

   100

   101

    def _parse_timestamp (self, match) :

   102

        """

   103

            Parse the timestamp field into a datetime.datetime from the given match object

   104

        """

   105

   106

        timestamp = match.group('timestamp')

   107

   108

        try :

   109

            ts = time.strptime(timestamp, self.TIMESTAMP_FMT)

   110

   111

        except Exception, ex :

   112

            raise ValueError("Invalid timestamp: %s: %s" % (timestamp, ex))

   113

   114

        # build timestamp

   115

        self.timestamp = datetime.datetime(

   116

            # fix year - strptime default is 1900

   117

            ts.tm_year if ts.tm_year != 1900 else time.localtime().tm_year,

   118

   119

            # month, day, hour, minute, second

   120

            *ts[1:6]

   121

        )

   122

   123

    def _parse_hostname (self, match) :

   124

        """

   125

            Parse the hostname from the given match object

   126

        """

   127

   128

        # nothing much needed..

   129

        self.hostname = match.group('hostname')

   130

   131

    def _parse_message (self, match) :

   132

        """

   133

            Parse the message with tag from the given match object

   134

        """

   135

   136

        self.message = match.group('message')

   137

        self.tag = match.group('tag')

   138

        self.program = match.group('program')

   139

        self.pid = int(match.group('pid')) if match.group('pid') else None

   140

        self.text = match.group('text')

   141

   142

    def __init__ (self, line) :

   143

        """

   144

            Construct this message from the given line

   145

        """

   146

   147

        # apply regexp

   148

        match = self.LINE_RE.match(line)

   149

   150

        if not match :

   151

            # fail

   152

            raise ValueError("Invalid syslog data format")

   153

   154

        # unpack the various portions

   155

        self._parse_pri(match)

   156

        self._parse_timestamp(match)

   157

        self._parse_hostname(match)

   158

        self._parse_message(match)

   159

   160

        # the raw line as matched

   161

        self.raw = match.group(0)

   162

   163

    def properties (self) :

   164

        """

   165

            Return a dict containing the attributes specified for this message

   166

        """

   167

   168

        # XXX: ugh... doesn't do @property

   169

        return dict(

   170

            facility        = self.facility,

   171

            priority        = self.priority,

   172

            timestamp       = self.timestamp,

   173

            hostname        = self.hostname,

   174

            tag             = self.tag,

   175

            program         = self.program,

   176

            pid             = self.pid,

   177

            text            = self.text,

   178

            message         = self.message,

   179

        )

   180

   217

    def match (self, regexp=None, program=None) :

   218

        """

   219

            Evaluate a match against this message using the given criteria

   220

   221

                regexp          - match regexp against the message's contents

   222

                program         - match program component of tag against given value, may also be False

   223

        """

   224

   225

        params = {}

   226

   230

                return False

   231

   232

        ## pattern

   233

        if regexp is not None :

   234

            # apply regexp

   235

            match = regexp.match(self.text)

   236

   237

            if not match :

   238

                # no match

   239

                return False

   240

   241

            # good, params

   242

            params.update(match.groupdict())

   243

   244

        # we appear to have a match

   245

        return params

   246

   247

    def __str__ (self) :

   248

        """

   249

            Format to default format

   250

        """

   251

   252

        return "%s %s %s" % (self.timestamp.strftime(self.TIMESTAMP_FMT), self.hostname, self.message)

   253

   254

    def __repr__ (self) :

   255

        return "pri=%s:%s, timestamp=%s, hostname=%s, tag=%s[%s], text=%r" % (

   256

            self.facility, self.priority, self.timestamp.isoformat(), self.hostname, self.program, self.pid, self.text

   257

        )

   258