Skip to content

feat(rfc3164): extend RFC3164 parser to support Cisco IOS logs #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leodido merged 23 commits into from
Oct 5, 2025
Merged

feat(rfc3164): extend RFC3164 parser to support Cisco IOS logs #22

Show file tree
Hide file tree
Changes from 22 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
9d05d6b
Extend RFC3164 parser to support Cisco iOS logs
alistairking Jan 8, 2025
0809b7a
Make sequence parsing optional
alistairking Jan 27, 2025
4e9b865
Make trailing colon depend on sequence being enabled
alistairking Mar 11, 2025
a858502
Switch sequence to uint32
alistairking Mar 11, 2025
ccd2db3
make rfc3164/machine.go
alistairking Mar 11, 2025
b7d2a64
Add another doc link
alistairking Mar 12, 2025
de9a5bf
Better comment (thanks to @go3ranh)
alistairking Mar 12, 2025
bf548e7
Make * optional, rebuild machine.go
alistairking Mar 12, 2025
8e38f18
Add WithCiscoHostname to parse non-standard Cisco hostname
alistairking Apr 16, 2025
077d715
Apparently the space is optional
alistairking Apr 16, 2025
0fe7b25
Fix test
alistairking Apr 16, 2025
f4bcfec
Rename WithSequence to WithSequenceNumber
alistairking Apr 16, 2025
f5044c5
Give it all some structure
alistairking Apr 16, 2025
7673e29
fix(rfc3164): use ciscostar rule
leodido Apr 17, 2025
77b5fe5
feat(ciscoios): refactor Cisco IOS component flags into their own pac…
leodido Apr 17, 2025
f96fa1f
test(rfc5424): fixup example tests (SyslogMessage now contains 2 new …
leodido Apr 17, 2025
a15c0c8
test(nontransparent): fixup example tests (SyslogMessage now contains…
leodido Apr 17, 2025
2422566
test(octetcounting): fixup example tests (SyslogMessage now contains …
leodido Apr 17, 2025
5c4c50b
test(rfc3164): fixup example tests (SyslogMessage now contains 2 new …
leodido Apr 17, 2025
f2bd82c
Add comments
alistairking Apr 17, 2025
5df9d65
Add some more tests
alistairking Apr 17, 2025
db6cfd8
Update comments
alistairking Apr 17, 2025
7c89f9a
chore: restructuring grammar for Cisco IOS case
leodido Apr 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions ciscoios/flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
package ciscoios

type Component int

const (
All Component = 0
DisableMessageCounter Component = 0x01
DisableSequenceNumber Component = 0x02
DisableHostname Component = 0x04
DisableSecondFractions Component = 0x08
)
18 changes: 18 additions & 0 deletions nontransparent/example_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,8 @@ func Example_withCurrentYear_RFC3164() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2021-12-02 16:31:03 +0000 UTC),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand Down Expand Up @@ -91,6 +93,8 @@ func Example_bestEffortWithoutTrailerAtEnd() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2003-10-11 22:14:15.003 +0000 UTC),
// Hostname: (*string)((len=10) "host.local"),
// Appname: (*string)(<nil>),
Expand Down Expand Up @@ -122,6 +126,8 @@ func Example_bestEffortOnLastOne() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -140,6 +146,8 @@ func Example_bestEffortOnLastOne() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(3),
// Priority: (*uint8)(3),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand Down Expand Up @@ -202,6 +210,8 @@ func Example_intoChannelWithLF() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(2),
// Priority: (*uint8)(2),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -220,6 +230,8 @@ func Example_intoChannelWithLF() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -238,6 +250,8 @@ func Example_intoChannelWithLF() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand Down Expand Up @@ -301,6 +315,8 @@ func Example_intoChannelWithNUL() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(2),
// Priority: (*uint8)(2),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -323,6 +339,8 @@ func Example_intoChannelWithNUL() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand Down
24 changes: 24 additions & 0 deletions octetcounting/example_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ func Example() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2003-10-11 22:14:15.003 +0000 UTC),
// Hostname: (*string)((len=10) "host.local"),
// Appname: (*string)(<nil>),
Expand All @@ -51,6 +53,8 @@ func Example() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(3),
// Priority: (*uint8)(3),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)((len=10) "host.local"),
// Appname: (*string)(<nil>),
Expand All @@ -69,6 +73,8 @@ func Example() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(2),
// Priority: (*uint8)(2),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)((len=10) "host.local"),
// Appname: (*string)((len=2) "su"),
Expand Down Expand Up @@ -126,6 +132,8 @@ func Example_channel() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -144,6 +152,8 @@ func Example_channel() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(2),
// Priority: (*uint8)(2),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -162,6 +172,8 @@ func Example_channel() {
// Facility: (*uint8)(0),
// Severity: (*uint8)(1),
// Priority: (*uint8)(1),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(<nil>),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand Down Expand Up @@ -218,6 +230,8 @@ func Example_channelOpenBSD() {
// Facility: (*uint8)(5),
// Severity: (*uint8)(6),
// Priority: (*uint8)(46),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-04-28 11:53:44 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)((len=7) "syslogd"),
Expand All @@ -234,6 +248,8 @@ func Example_channelOpenBSD() {
// Facility: (*uint8)(5),
// Severity: (*uint8)(7),
// Priority: (*uint8)(47),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-04-28 11:53:44 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)((len=7) "syslogd"),
Expand All @@ -250,6 +266,8 @@ func Example_channelOpenBSD() {
// Facility: (*uint8)(10),
// Severity: (*uint8)(6),
// Priority: (*uint8)(86),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-04-28 11:53:46 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)((len=4) "doas"),
Expand Down Expand Up @@ -319,6 +337,8 @@ func Example_channelOpenBSDWithCurrentYear() {
// Facility: (*uint8)(5),
// Severity: (*uint8)(6),
// Priority: (*uint8)(46),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2024-04-28 11:53:44 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)((len=7) "syslogd"),
Expand All @@ -335,6 +355,8 @@ func Example_channelOpenBSDWithCurrentYear() {
// Facility: (*uint8)(5),
// Severity: (*uint8)(7),
// Priority: (*uint8)(47),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2024-04-28 11:53:44 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)((len=7) "syslogd"),
Expand All @@ -351,6 +373,8 @@ func Example_channelOpenBSDWithCurrentYear() {
// Facility: (*uint8)(10),
// Severity: (*uint8)(6),
// Priority: (*uint8)(86),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2024-04-28 11:53:46 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)((len=4) "doas"),
Expand Down
44 changes: 44 additions & 0 deletions rfc3164/example_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"time"

"github.com/davecgh/go-spew/spew"
"github.com/leodido/go-syslog/v4/ciscoios"
)

func init() {
Expand All @@ -26,6 +27,8 @@ func Example() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-12-02 16:31:03 +0000 UTC),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand Down Expand Up @@ -56,6 +59,8 @@ func Example_currentyear() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2021-12-02 16:31:03 +0000 UTC),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -78,6 +83,8 @@ func Example_withtimezone() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-01-30 03:08:03 +0100 CET),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -100,6 +107,8 @@ func Example_withlocaletimezone() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-11-22 17:09:42 -0456 LMT),
// Hostname: (*string)((len=3) "xxx"),
// Appname: (*string)((len=6) "kernel"),
Expand All @@ -122,6 +131,8 @@ func Example_withtimezone_and_year() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(1987-01-29 21:08:03 -0500 EST),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -143,6 +154,8 @@ func Example_besteffort() {
// Facility: (*uint8)(1),
// Severity: (*uint8)(5),
// Priority: (*uint8)(13),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(0000-12-02 16:31:03 +0000 UTC),
// Hostname: (*string)(<nil>),
// Appname: (*string)(<nil>),
Expand All @@ -164,6 +177,8 @@ func Example_rfc3339timestamp() {
// Facility: (*uint8)(3),
// Severity: (*uint8)(4),
// Priority: (*uint8)(28),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2019-12-02 16:49:23 +0200 +0200),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -185,6 +200,8 @@ func Example_stamp_also_when_rfc3339() {
// Facility: (*uint8)(3),
// Severity: (*uint8)(4),
// Priority: (*uint8)(28),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2019-12-02 16:49:23 +0000 UTC),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -206,6 +223,8 @@ func Example_stampmilli() {
// Facility: (*uint8)(3),
// Severity: (*uint8)(4),
// Priority: (*uint8)(28),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2025-12-02 16:49:23.123 +0000 UTC),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -227,6 +246,8 @@ func Example_stampmicro() {
// Facility: (*uint8)(3),
// Severity: (*uint8)(4),
// Priority: (*uint8)(28),
// MessageCounter: (*uint32)(<nil>),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2025-12-02 16:49:23.654321 +0000 UTC),
// Hostname: (*string)((len=4) "host"),
// Appname: (*string)((len=3) "app"),
Expand All @@ -236,3 +257,26 @@ func Example_stampmicro() {
// }
// })
}

func Example_ciscoIOS() {
i := []byte(`<189>269614: myhostname: Apr 11 10:02:08: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet7/0/34, changed state to up`)
p := NewParser(WithYear(Year{YYYY: 2025}), WithCiscoIOSComponents(ciscoios.All))
m, _ := p.Parse(i)
output(m)
// Output:
// (*rfc3164.SyslogMessage)({
// Base: (syslog.Base) {
// Facility: (*uint8)(23),
// Severity: (*uint8)(5),
// Priority: (*uint8)(189),
// MessageCounter: (*uint32)(269614),
// Sequence: (*uint32)(<nil>),
// Timestamp: (*time.Time)(2025-04-11 10:02:08 +0000 UTC),
// Hostname: (*string)((len=10) "myhostname"),
// Appname: (*string)((len=19) "%LINEPROTO-5-UPDOWN"),
// ProcID: (*string)(<nil>),
// MsgID: (*string)(<nil>),
// Message: (*string)((len=69) "Line protocol on Interface GigabitEthernet7/0/34, changed state to up")
// }
// })
}
Loading