Syslog(3)

NAME
Lire::Syslog - syslog style lines parser

SYNOPSIS
use Lire::Syslog;

my $parser = new Lire::Syslog;

my $rec = $parser->parse( $line );

DESCRIPTION
This module defines objects able to parse logs coming from several flavours of logging daemon.

It currently supports the following syslog file formats: The "classic" BSD syslog format:

    MMM DD HH:MM:SS Hostname Message The Solaris 8 syslog daemon also includes the facility and level:

    MMM DD HH:MM:SS Hostname Process[Pid]: [ID DDDDDD Facility.Level] Message
The syslog daemon that comes with Netscape Messaging Server uses a date in common log format:

    [DD/MMM/YYYY:HH:MM:SS +ZZZZ] Hostname Process[Pid]: Facility Level: Message

=item Kiwi Syslog (ISO date format)
The ISO log file formats used by the Kiwi Syslog daemon (http://www.kiwisyslog.com/info_sysd.htm), a logging daemon often encounters on Win32 platforms:

    YYYY-MM-DD HH:MM:SS [TAB] Facility.Level [TAB] Hostname [TAB] Message
The US date format used by the Kiwi Syslog daemon:

    MM-DD-YYYY HH:MM:SS [TAB] Facility.Level [TAB] Hostname [TAB] Message
The DD-MM-YYYY date format used by the Kiwi Syslog daemon:

    DD-MM-YYYY HH:MM:SS [TAB] Facility.Level [TAB] Hostname [TAB] Message
vThe format used by the logging daemon coming with Sendmail Switch on Win32 platforms:

    MM/DD/YY HH:MM:SS Process(Pid): Level: Message
A format from an unknown syslog daemon which includes the encoded priority and the year in the date. (Note: if you know the name of the syslog daemon that uses this format, please let us know!)

    <Pririty>MMM DD YYYY HH:MM:SS: Process[Pid]: Message

The first time the parse() method is used, the parser will try each of the supported format to detect the syslog format. If no format matches, the module will call lr_err() and aborts the program. Each other parse() invocation will use the same format.

The parse() method will return an hash reference which contains the following keys: The timestamp of the event. The host name or ip address that sended the message. The "process" that logged the event. Formally, the syslog message doesn't contains a process field but its usually the first word coming before a colon in the message's content. The PID of the process that logged the event. This is usually what is between [] in the process part of the message. This key is only present when the log comes from a Solaris 8 syslog daemon. It contains the identifier that comes after ID in the message. The syslog facility (kern, mail, local0, etc.) of the message. This isn't supported in all file formats so this key might be unavailable. The syslog level (emerg, info, notice, etc. ) of the message. This isn't supported in all file formats so this key might be unavailable. The actual syslog message (with the process and pid removed). Many network devices will also have another BSD-style timestamp at the beginning of the message. If present, it will also be removed.

USAGE

 package Lire::Foo;
 require Lire::Syslog;
 @ISA = qw/ Lire::Syslog /;
 sub parse {
    my $self = shift;
    my $line = shift;
    # this runs parse from Lire::Syslog, setting keys like 'day', 'process'
    # and 'hostname'
    my $rec = $self->SUPER::parse($line);
    $rec->{'foo'} = dosomethingwith( $rec->{content} );
    return $rec
 }
Now, one can run in a script

 my $parser = new Lire::Foo();
 while ( <> ) {
    chomp;
    my $log = $parser->parse( $line );
 }
which sets $log->{'day'}, ... $log->{'process'} and $log->{'foo'}.

SEE ALSO
Lire::Email(3)

AUTHORS
Joost van Baal, based on an idea by Joost Kooij Francis J. Lacoste

VERSION
$Id: Syslog.pm,v 1.27 2002/08/19 02:04:01 flacoste Exp $

COPYRIGHT
Copyright (C) 2000-2002 Stichting LogReport Foundation LogReport@LogReport.org

This file is part of Lire.

Lire is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html or write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.