rfc5424

package
v3.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 5, 2020 License: MIT Imports: 6 Imported by: 30

Documentation

Overview

Example 
i := []byte(`<165>4 2018-10-11T22:14:15.003Z mymach.it e - 1 [ex@32473 iut="3"] An application event log entry...`)
p := NewParser()
m, _ := p.Parse(i)
output(m)

Output:

(*rfc5424.SyslogMessage)({
 Base: (syslog.Base) {
  Facility: (*uint8)(20),
  Severity: (*uint8)(5),
  Priority: (*uint8)(165),
  Timestamp: (*time.Time)(2018-10-11 22:14:15.003 +0000 UTC),
  Hostname: (*string)((len=9) "mymach.it"),
  Appname: (*string)((len=1) "e"),
  ProcID: (*string)(<nil>),
  MsgID: (*string)((len=1) "1"),
  Message: (*string)((len=33) "An application event log entry...")
 },
 Version: (uint16) 4,
 StructuredData: (*map[string]map[string]string)((len=1) {
  (string) (len=8) "ex@32473": (map[string]string) (len=1) {
   (string) (len=3) "iut": (string) (len=1) "3"
  }
 })
})
Example (Besteffort) 
i := []byte(`<1>1 A - - - - - -`)
p := NewParser(WithBestEffort())
m, e := p.Parse(i)
output(m)
fmt.Println(e)

Output:

(*rfc5424.SyslogMessage)({
 Base: (syslog.Base) {
  Facility: (*uint8)(0),
  Severity: (*uint8)(1),
  Priority: (*uint8)(1),
  Timestamp: (*time.Time)(<nil>),
  Hostname: (*string)(<nil>),
  Appname: (*string)(<nil>),
  ProcID: (*string)(<nil>),
  MsgID: (*string)(<nil>),
  Message: (*string)(<nil>)
 },
 Version: (uint16) 1,
 StructuredData: (*map[string]map[string]string)(<nil>)
})
expecting a RFC3339MICRO timestamp or a nil value [col 5]
Example (Builder) 
msg := &SyslogMessage{}
msg.SetTimestamp("not a RFC3339MICRO timestamp")
fmt.Println("Valid?", msg.Valid())
msg.SetPriority(191)
msg.SetVersion(1)
fmt.Println("Valid?", msg.Valid())
output(msg)
str, _ := msg.String()
fmt.Println(str)

Output:

Valid? false
Valid? true
(*rfc5424.SyslogMessage)({
 Base: (syslog.Base) {
  Facility: (*uint8)(23),
  Severity: (*uint8)(7),
  Priority: (*uint8)(191),
  Timestamp: (*time.Time)(<nil>),
  Hostname: (*string)(<nil>),
  Appname: (*string)(<nil>),
  ProcID: (*string)(<nil>),
  MsgID: (*string)(<nil>),
  Message: (*string)(<nil>)
 },
 Version: (uint16) 1,
 StructuredData: (*map[string]map[string]string)(<nil>)
})
<191>1 - - - - - -

Index

Examples

Constants

View Source 
const (
	// ErrPrival represents an error in the priority value (PRIVAL) inside the PRI part of the RFC5424 syslog message.
	ErrPrival = "expecting a priority value in the range 1-191 or equal to 0"
	// ErrPri represents an error in the PRI part of the RFC5424 syslog message.
	ErrPri = "expecting a priority value within angle brackets"
	// ErrVersion represents an error in the VERSION part of the RFC5424 syslog message.
	ErrVersion = "expecting a version value in the range 1-999"
	// ErrTimestamp represents an error in the TIMESTAMP part of the RFC5424 syslog message.
	ErrTimestamp = "expecting a RFC3339MICRO timestamp or a nil value"
	// ErrHostname represents an error in the HOSTNAME part of the RFC5424 syslog message.
	ErrHostname = "expecting an hostname (from 1 to max 255 US-ASCII characters) or a nil value"
	// ErrAppname represents an error in the APP-NAME part of the RFC5424 syslog message.
	ErrAppname = "expecting an app-name (from 1 to max 48 US-ASCII characters) or a nil value"
	// ErrProcID represents an error in the PROCID part of the RFC5424 syslog message.
	ErrProcID = "expecting a procid (from 1 to max 128 US-ASCII characters) or a nil value"
	// ErrMsgID represents an error in the MSGID part of the RFC5424 syslog message.
	ErrMsgID = "expecting a msgid (from 1 to max 32 US-ASCII characters) or a nil value"
	// ErrStructuredData represents an error in the STRUCTURED DATA part of the RFC5424 syslog message.
	ErrStructuredData = "expecting a structured data section containing one or more elements (`[id( key=\"value\")*]+`) or a nil value"
	// ErrSdID represents an error regarding the ID of a STRUCTURED DATA element of the RFC5424 syslog message.
	ErrSdID = "expecting a structured data element id (from 1 to max 32 US-ASCII characters; except `=`, ` `, `]`, and `\"`"
	// ErrSdIDDuplicated represents an error occurring when two STRUCTURED DATA elementes have the same ID in a RFC5424 syslog message.
	ErrSdIDDuplicated = "duplicate structured data element id"
	// ErrSdParam represents an error regarding a STRUCTURED DATA PARAM of the RFC5424 syslog message.
	ErrSdParam = "" /* 215-byte string literal not displayed */
	// ErrMsg represents an error in the MESSAGE part of the RFC5424 syslog message.
	ErrMsg = "expecting a free-form optional message in UTF-8 (starting with or without BOM)"
	// ErrEscape represents the error for a RFC5424 syslog message occurring when a STRUCTURED DATA PARAM value contains '"', '\', or ']' not escaped.
	ErrEscape = "expecting chars `]`, `\"`, and `\\` to be escaped within param value"
	// ErrParse represents a general parsing error for a RFC5424 syslog message.
	ErrParse = "parsing error"
)
View Source 
const RFC3339MICRO = "2006-01-02T15:04:05.999999Z07:00"

RFC3339MICRO represents the timestamp format that RFC5424 mandates.

Variables

View Source 
var ColumnPositionTemplate = " [col %d]"

ColumnPositionTemplate is the template used to communicate the column where errors occur.

Functions

func NewMachine 

func NewMachine(options ...syslog.MachineOption) syslog.Machine

NewMachine creates a new FSM able to parse RFC5424 syslog messages.

func NewParser 

func NewParser(options ...syslog.MachineOption) syslog.Machine

NewParser creates a syslog.Machine that parses RFC5424 syslog messages.

func WithBestEffort 

func WithBestEffort() syslog.MachineOption

WithBestEffort enables the best effort mode.

Types

type Builder 

type Builder interface {
	syslog.Message

	SetPriority(value uint8) Builder
	SetVersion(value uint16) Builder
	SetTimestamp(value string) Builder
	SetHostname(value string) Builder
	SetAppname(value string) Builder
	SetProcID(value string) Builder
	SetMsgID(value string) Builder
	SetElementID(value string) Builder
	SetParameter(id string, name string, value string) Builder
	SetMessage(value string) Builder
}

Builder represents a RFC5424 syslog message builder.

type SyslogMessage 

type SyslogMessage struct {
	syslog.Base

	Version        uint16 // Grammar mandates that version cannot be 0, so we can use the 0 value of uint16 to signal nil
	StructuredData *map[string]map[string]string
}

SyslogMessage represents a RFC5424 syslog message.

func (*SyslogMessage) SetAppname 

func (sm *SyslogMessage) SetAppname(value string) Builder

SetAppname set the appname value.

func (*SyslogMessage) SetElementID 

func (sm *SyslogMessage) SetElementID(value string) Builder

SetElementID set a structured data id.

When the provided id already exists the operation is discarded.

func (*SyslogMessage) SetHostname 

func (sm *SyslogMessage) SetHostname(value string) Builder

SetHostname set the hostname value.

func (*SyslogMessage) SetMessage 

func (sm *SyslogMessage) SetMessage(value string) Builder

SetMessage set the message value.

func (*SyslogMessage) SetMsgID 

func (sm *SyslogMessage) SetMsgID(value string) Builder

SetMsgID set the msgid value.

func (*SyslogMessage) SetParameter 

func (sm *SyslogMessage) SetParameter(id string, name string, value string) Builder

SetParameter set a structured data parameter belonging to the given element.

If the element does not exist it creates one with the given element id. When a parameter with the given name already exists for the given element the operation is discarded.

func (*SyslogMessage) SetPriority 

func (sm *SyslogMessage) SetPriority(value uint8) Builder

SetPriority set the priority value and the computed facility and severity codes accordingly.

It ignores incorrect priority values (range [0, 191]).

func (*SyslogMessage) SetProcID 

func (sm *SyslogMessage) SetProcID(value string) Builder

SetProcID set the procid value.

func (*SyslogMessage) SetTimestamp 

func (sm *SyslogMessage) SetTimestamp(value string) Builder

SetTimestamp set the timestamp value.

func (*SyslogMessage) SetVersion 

func (sm *SyslogMessage) SetVersion(value uint16) Builder

SetVersion set the version value.

It ignores incorrect version values (range ]0, 999]).

func (*SyslogMessage) String 

func (sm *SyslogMessage) String() (string, error)

func (*SyslogMessage) Valid 

func (sm *SyslogMessage) Valid() bool

Valid tells whether the receiving RFC5424 SyslogMessage is well-formed or not.

A minimally well-formed RFC5424 syslog message contains at least a priority ([1, 191] or 0) and the version (]0, 999]).

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.