enhance: add option to disable magic syslog RFC parsers#3435
Conversation
|
@LaurenceJJones: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
@LaurenceJJones: There are no area labels on this PR. You can add as many areas as you see fit.
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
/kind enhancement |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3435 +/- ##
==========================================
+ Coverage 52.45% 56.66% +4.21%
==========================================
Files 391 391
Lines 43549 43579 +30
==========================================
+ Hits 22842 24694 +1852
+ Misses 18693 16793 -1900
- Partials 2014 2092 +78
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
ref: crowdsecurity/hub#940 (comment)
the syslog datasource RFC parsers cannot handle everything we want and its a chore to make a RFC compliant parser the one for now is good for 90% of cases but for those 10% it causes a roadblock.
This PR add the option to
disable_rfc_parserto the syslog acquisition which simply allows to disable the magic parsers and simply remove thePRI(since our syslog or unifi parser does not handle PRI's) and send the log line as is.We spoke about it ages ago @blotus 😅