Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Make Syslog analyzer accept messages that omit Priority

Browse source 
Essentially, it will now process/parse priority values if they are
there, or else just accept whatever remaining data/text is there as the
syslog message.  Reasoning is that there's syslog producers out there
that may have simply forgotten/neglected to send the priority value
and technically won't conform to what the standard says, though we can
infer the intent (some syslog consumers already may do similarly, but
I didn't verify).
This commit is contained in:
Jon Siwek 2019-03-14 18:47:32 -07:00
parent 158313875c
commit be7110f6c0
7 changed files with 55 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/syslog/consts.bro
View file

@ -29,6 +29,7 @@ export {
[21] = "LOCAL5",
[22] = "LOCAL6",
[23] = "LOCAL7",
[999] = "UNSPECIFIED",
} &default=function(c: count): string { return fmt("?-%d", c); };
## Mapping between the constants and string values for syslog severities.
@ -41,5 +42,6 @@ export {
[5] = "NOTICE",
[6] = "INFO",
[7] = "DEBUG",
[999] = "UNSPECIFIED",
} &default=function(c: count): string { return fmt("?-%d", c); };
}
}