Skip to content

enhance: add option to disable magic syslog RFC parsers#3435

Merged
blotus merged 6 commits into
crowdsecurity:masterfrom
LaurenceJJones:rfc3164_parser_update
Feb 28, 2025
Merged

enhance: add option to disable magic syslog RFC parsers#3435
blotus merged 6 commits into
crowdsecurity:masterfrom
LaurenceJJones:rfc3164_parser_update

Conversation

@LaurenceJJones
Copy link
Copy Markdown
Contributor

ref: crowdsecurity/hub#940 (comment)

the syslog datasource RFC parsers cannot handle everything we want and its a chore to make a RFC compliant parser the one for now is good for 90% of cases but for those 10% it causes a roadblock.

This PR add the option to disable_rfc_parser to the syslog acquisition which simply allows to disable the magic parsers and simply remove the PRI (since our syslog or unifi parser does not handle PRI's) and send the log line as is.

We spoke about it ages ago @blotus 😅

@github-actions
Copy link
Copy Markdown

@LaurenceJJones: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

  • /kind feature
  • /kind enhancement
  • /kind refactoring
  • /kind fix
  • /kind chore
  • /kind dependencies
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

@github-actions
Copy link
Copy Markdown

@LaurenceJJones: There are no area labels on this PR. You can add as many areas as you see fit.

  • /area agent
  • /area local-api
  • /area cscli
  • /area appsec
  • /area security
  • /area configuration
Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

@LaurenceJJones
Copy link
Copy Markdown
Contributor Author

LaurenceJJones commented Jan 29, 2025

/kind enhancement
/area agent

@LaurenceJJones LaurenceJJones added kind/enhancement New feature or request and removed needs/kind labels Jan 29, 2025
@codecov
Copy link
Copy Markdown

codecov Bot commented Jan 29, 2025

Codecov Report

Attention: Patch coverage is 84.48276% with 9 lines in your changes missing coverage. Please review.

Project coverage is 56.66%. Comparing base (c5f5896) to head (975ba62).
Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
pkg/acquisition/modules/syslog/syslog.go 84.48% 6 Missing and 3 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3435      +/-   ##
==========================================
+ Coverage   52.45%   56.66%   +4.21%     
==========================================
  Files         391      391              
  Lines       43549    43579      +30     
==========================================
+ Hits        22842    24694    +1852     
+ Misses      18693    16793    -1900     
- Partials     2014     2092      +78     
Flag Coverage Δ
bats 40.96% <0.00%> (-0.06%) ⬇️
unit-linux 33.68% <84.48%> (?)
unit-windows 22.69% <77.58%> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@LaurenceJJones LaurenceJJones added this to the 1.6.6 milestone Jan 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/agent kind/enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants