1

import datetime, time

     2

import re

     3

     4

import logging; log = logging.getLogger('pvl.syslog.parser')

     5

     6

class SyslogParser (object) :

     7

    """

     8

        Parse syslog lines in text format, as used in logfiles/fifos.

     9

    """

    10

    11

    # default syslogd format

    12

    SYSLOG_RE = re.compile(

    13

        # the timestamp+hostname header

    14

        # XXX:  hostname may be missing

    15

        #       at least in Ubuntu 11.10 syslogd 'last message repeated 2 times'...

    16

            r"(?P<timestamp>\w{3} [0-9 ]\d \d{2}:\d{2}:\d{2}) (?P<hostname>\S+)? "

    17

    18

        # the message, including possible tag/pid

    19

        +   r"(?P<message>(?P<tag>(?P<program>[^:\]]+)(?:\[(?P<pid>\d+)\])?: )?(?P<text>.*))\n?"

    20

    )

    21

    22

    TIMESTAMP_FMT = '%b %d %H:%M:%S'

    23

    24

    def __init__ (self, raw=False) :

    25

        """

    26

            Using given underlying line source.

    27

        """

    28

    29

        self.raw = raw

    30

    31

    def parse_timestamp (self, match) :

    32

        """

    33

            Parse timstamp from line into datetime.

    34

        """

    35

    36

        timestamp = match.group('timestamp')

    37

    38

        # add missing year; assume current

    39

        timestamp = time.strftime('%Y') + ' ' + timestamp

    40

    41

        # k

    42

        timestamp = datetime.datetime.strptime(timestamp, '%Y ' + self.TIMESTAMP_FMT)

    43

    44

        return timestamp

    45

    46

    def parse_prog (self, match) :

    47

        """

    48

            Parse prog from line.

    49

        """

    50

    51

        prog = match.group('program')

    52

    53

        if prog :

    54

            return prog

    55

        else :

    56

            # no tag

    57

            return None

    58

    59

    def parse (self, line) :

    60

        """

    61

            Parse given input line into SyslogMessage.

    62

        """

    63

    64

        # ignore whitespace

    65

        line = line.strip()

    66

    67

        # debug

    68

        log.debug("%s", line)

    69

    70

        # timestamp?

    71

        if self.raw :

    72

            # from defaults

    73

            return dict(

    74

                timestamp   = datetime.datetime.now(), # XXX: None?

    75

                host        = None,

    76

                prog        = None,

    77

                pid         = None,

    78

                msg         = line,

    79

            )

    80

    81

        else :

    82

            # parse

    83

            match = self.SYSLOG_RE.match(line)

    84

    85

            if not match :

    86

                log.warn("Unparseable syslog message: %r", line)

    87

                return

    88

    89

            # parse

    90

            return dict(

    91

                timestamp   = self.parse_timestamp(match),

    92

                host        = match.group('hostname'),

    93

                prog        = self.parse_prog(match),

    94

                pid         = match.group('pid'),

    95

                msg         = match.group('text'),

    96

            )

    97

    98

    def process (self, lines) :

    99

        """

   100

            Yield SyslogMessages from given series of lines.

   101

        """

   102

   103

        for line in lines :

   104

            item = self.parse(line)

   105

   106

            if item :

   107

                yield item

   108

   109

    __call__ = process

   110