1

"""

     2

    Parse syslog lines in text format.

     3

"""

     4

     5

import datetime, time

     6

import re

     7

     8

import logging; log = logging.getLogger('pvl.syslog.parser')

     9

    10

class SyslogParser (object) :

    11

    """

    12

        A source of syslog items.

    13

    """

    14

    15

    # default syslogd format

    16

    SYSLOG_RE = re.compile(

    17

        # the timestamp+hostname header

    18

            r"(?P<timestamp>\w{3} [0-9 ]\d \d{2}:\d{2}:\d{2}) (?P<hostname>\S+) "

    19

    20

        # the message, including possible tag/pid

    21

        +   r"(?P<message>(?P<tag>(?P<program>[^:\]]+)(?:\[(?P<pid>\d+)\])?: )?(?P<text>.*))\n?"

    22

    )

    23

    24

    TIMESTAMP_FMT = '%b %d %H:%M:%S'

    25

    26

    def __init__ (self, raw=False, prog=None) :

    27

        """

    28

            Using given underlying line source.

    29

        """

    30

    31

        self.raw = raw

    32

        self.prog = prog

    33

    34

    def parse_timestamp (self, match) :

    35

        """

    36

            Parse timstamp from line into datetime.

    37

        """

    38

    39

        timestamp = match.group('timestamp')

    40

    41

        # add missing year; assume current

    42

        timestamp = time.strftime('%Y') + ' ' + timestamp

    43

    44

        # k

    45

        timestamp = datetime.datetime.strptime(timestamp, '%Y ' + self.TIMESTAMP_FMT)

    46

    47

        return timestamp

    48

    49

    def parse_prog (self, match) :

    50

        """

    51

            Parse prog from line.

    52

        """

    53

    54

        prog = match.group('program')

    55

    56

        if not prog :

    57

            # no tag

    58

            return None

    59

    60

        # normalize

    61

        prog = prog.lower()

    62

    63

        if prog.startswith('/') :

    64

            # base

    65

            prog = prog.split('/')[-1]

    66

    67

        return prog

    68

    69

    def parse (self, line) :

    70

        """

    71

            Parse given input line into SyslogMessage.

    72

        """

    73

    74

        # ignore whitespace

    75

        line = line.strip()

    76

    77

        # debug

    78

        log.debug("%s", line)

    79

    80

        # timestamp?

    81

        if self.raw :

    82

            # from defaults

    83

            return dict(

    84

                timestamp   = datetime.datetime.now(), # XXX: None?

    85

                host        = None,

    86

                prog        = self.prog,

    87

                pid         = None,

    88

                msg         = line,

    89

            )

    90

    91

        else :

    92

            # parse

    93

            match = self.SYSLOG_RE.match(line)

    94

    95

            if not match :

    96

                log.warn("Unparseable syslog message: %r", line)

    97

                return

    98

    99

            # parse

   100

            return dict(

   101

                timestamp   = self.parse_timestamp(match),

   102

                host        = match.group('hostname'),

   103

                prog        = self.parse_prog(match),

   104

                pid         = match.group('pid'),

   105

                msg         = match.group('text'),

   106

            )

   107

   108

    def match_prog (self, prog) :

   109

        """

   110

            Match given prog?

   111

        """

   112

   113

        if not prog :

   114

            # never matches non-tagged lines

   115

            return False

   116

   117

        elif self.prog.endswith('*') :

   118

            # prefix match

   119

            return prog.startswith(self.prog[:-1])

   120

        else :

   121

            return prog == self.prog

   122

   123

   124

    def filter (self, line, item) :

   125

        """

   126

            Filter given item?

   127

        """

   128

   129

        if not item :

   130

            log.debug("empty: %r", line)

   131

   132

        elif self.prog and not self.match_prog(item['prog']) :

   133

            log.debug("prog: %r", item)

   134

   135

        else :

   136

            # ok

   137

            return True

   138

   139

    def process (self, lines) :

   140

        """

   141

            Yield SyslogMessages from given series of lines.

   142

        """

   143

   144

        for line in lines :

   145

            item = self.parse(line)

   146

   147

            # filter?

   148

            if self.filter(line, item) :

   149

                yield item

   150

   151

   152