1

"""

     2

    Log messages (e.g. syslog)

     3

"""

     4

     5

# stdlib syslog, for facilities and levels

     6

import syslog

     7

import time, datetime

     8

import re

     9

    10

PRIORITY_NAMES = {

    11

    syslog.LOG_EMERG:       'emerg',

    12

    syslog.LOG_ALERT:       'alert', 

    13

    syslog.LOG_CRIT:        'crit', 

    14

    syslog.LOG_ERR:         'err',

    15

    syslog.LOG_WARNING:     'warning',

    16

    syslog.LOG_NOTICE:      'notice',

    17

    syslog.LOG_INFO:        'info', 

    18

    syslog.LOG_DEBUG:       'debug',

    19

}

    20

    21

FACILITY_NAMES = {

    22

    syslog.LOG_KERN:	'kern',     # 0

    23

    syslog.LOG_USER:	'user',     # 1

    24

    syslog.LOG_MAIL:	'mail',     # 2

    25

    syslog.LOG_DAEMON:	'daemon',   # 3

    26

    syslog.LOG_AUTH:	'auth',     # 4

    27

    5:                  'syslog',   # 5

    28

    syslog.LOG_LPR:	    'lpr',      # 6

    29

    syslog.LOG_NEWS:	'news',     # 7

    30

    syslog.LOG_UUCP:	'uucp',     # 8

    31

    syslog.LOG_CRON:	'cron',     # 9

    32

    10:                 'authpriv', # 10

    33

    11:                 'ftp',      # 11

    34

    12:                 'ntp',      # 12

    35

    13:                 'audit',    # 13

    36

    14:                 'alert',    # 14

    37

    15:                 'clock',    # 15

    38

    syslog.LOG_LOCAL0:	'local0',   # 16

    39

    syslog.LOG_LOCAL1:	'local1',   # 17

    40

    syslog.LOG_LOCAL2:	'local2',   # 18

    41

    syslog.LOG_LOCAL3:	'local3',   # 19

    42

    syslog.LOG_LOCAL4:	'local4',   # 20

    43

    syslog.LOG_LOCAL5:	'local5',   # 21

    44

    syslog.LOG_LOCAL6:	'local6',   # 22

    45

    syslog.LOG_LOCAL7:	'local7',   # 23

    46

}

    47

    48

class SyslogMessage (object) :

    49

    """

    50

        A message from syslog with the following fields:

    51

    52

            pri             - (optional) raw integer priority field

    53

            priority        - (optional) message priority as text

    54

            facility        - (optional) message facility as text

    55

            timestamp       - message timestamp as a datetime

    56

            hostname        - originating hostname

    57

            tag             - (optional) message tag including process name and id

    58

            program         - (optional) process name part of message tag

    59

            pid             - (optional) process ID part of message tag

    60

            text            - the log message following the tag

    61

            message         - the full log message including the tag

    62

            raw             - the full syslog-format message

    63

    """

    64

    65

    # the regular expression used to parse the lines

    66

    LINE_RE = re.compile(

    67

            # the priority field as in raw syslog messages

    68

            r"(?:<(?P<pri>\d+)>)?"

    69

    70

            # the timestamp+hostname header

    71

        +   r"(?P<timestamp>\w{3} [0-9 ]\d \d{2}:\d{2}:\d{2}) (?P<hostname>\S+)"

    72

    73

            # the message, including possible tag/pid

    75

    )

    76

    77

    # strptime format of timestamp

    78

    TIMESTAMP_FMT = "%b %d %H:%M:%S"

    79

    80

    def _parse_pri (self, match) :

    81

        """

    82

            Parse the priority/facility from the given match object

    83

        """

    84

    85

        # raw integer

    86

        self.pri = int(match.group('pri')) if match.group('pri') else None

    87

    88

        if self.pri :

    89

            # unpack

    90

            priority = self.pri % 8

    91

            facility = self.pri // 8

    92

    93

            # translate to names

    94

            self.priority = PRIORITY_NAMES.get(priority, str(priority))

    95

            self.facility = FACILITY_NAMES.get(facility, str(facility))

    96

    97

        else :

    98

            self.priority = self.facility = None

    99

   100

    def _parse_timestamp (self, match) :

   101

        """

   102

            Parse the timestamp field into a datetime.datetime from the given match object

   103

        """

   104

   105

        timestamp = match.group('timestamp')

   106

   107

        try :

   108

            ts = time.strptime(timestamp, self.TIMESTAMP_FMT)

   109

   110

        except Exception, ex :

   111

            raise ValueError("Invalid timestamp: %s: %s" % (timestamp, ex))

   112

   113

        # build timestamp

   114

        self.timestamp = datetime.datetime(

   115

            # fix year - strptime default is 1900

   116

            ts.tm_year if ts.tm_year != 1900 else time.localtime().tm_year,

   117

   118

            # month, day, hour, minute, second

   119

            *ts[1:6]

   120

        )

   121

   122

    def _parse_hostname (self, match) :

   123

        """

   124

            Parse the hostname from the given match object

   125

        """

   126

   127

        # nothing much needed..

   128

        self.hostname = match.group('hostname')

   129

   130

    def _parse_message (self, match) :

   131

        """

   132

            Parse the message with tag from the given match object

   133

        """

   134

   135

        self.message = match.group('message')

   136

        self.tag = match.group('tag')

   137

        self.program = match.group('program')

   138

        self.pid = int(match.group('pid')) if match.group('pid') else None

   139

        self.text = match.group('text')

   140

   141

    def __init__ (self, line) :

   142

        """

   143

            Construct this message from the given line

   144

        """

   145

   146

        # apply regexp

   147

        match = self.LINE_RE.match(line)

   148

   149

        if not match :

   150

            # fail

   151

            raise ValueError("Invalid syslog data format")

   152

   153

        # unpack the various portions

   154

        self._parse_pri(match)

   155

        self._parse_timestamp(match)

   156

        self._parse_hostname(match)

   157

        self._parse_message(match)

   158

   159

        # the raw line as matched

   160

        self.raw = match.group(0)

   179

   220

    def __str__ (self) :

   221

        """

   222

            Format to default format

   223

        """

   224

   225

        return "%s %s %s" % (self.timestamp.strftime(self.TIMESTAMP_FMT), self.hostname, self.message)

   226

   227

    def __repr__ (self) :

   228

        return "pri=%s:%s, timestamp=%s, hostname=%s, tag=%s[%s], text=%r" % (

   229

            self.facility, self.priority, self.timestamp.isoformat(), self.hostname, self.program, self.pid, self.text

   230

        )

   231