NAME

Parse::Syslog::Line - Simple syslog line parser

VERSION

version 3.3

SYNOPSIS

I wanted a very simple log parser for network based syslog input. Nothing existed that simply took a line and returned a hash ref all parsed out.

    use Parse::Syslog::Line qw(parse_syslog_line);

    $Parse::Syslog::Line::DateTimeCreate = 1;

    my $href = parse_syslog_line( $msg );
    #
    # $href = {
    #       preamble        => '13',
    #       priority        => 'notice',
    #       priority_int    => 5,
    #       facility        => 'user',
    #       facility_int    => 8,
    #       date            => 'YYYY-MM-DD',
    #       time            => 'HH::MM:SS',
    #       epoch           => 1361095933,
    #       datetime_str    => 'YYYY-MM-DD HH:MM:SS',
    #       datetime_obj    => new DateTime(), # If installed
    #       datetime_raw    => 'Feb 17 11:12:13'
    #       date_raw        => 'Feb 17 11:12:13'
    #       host_raw        => 'hostname',  # Hostname as it appeared in the message
    #       host            => 'hostname',  # Hostname without domain
    #       domain          => 'blah.com',  # if provided
    #       program_raw     => 'sshd(blah)[pid]',
    #       program_name    => 'sshd',
    #       program_sub     => 'pam_unix',
    #       program_pid     => 20345,
    #       content         => 'the rest of the message'
    #       message         => 'program[pid]: the rest of the message',
    #       message_raw     => 'The message as it was passed',
    #       ntp             => 'ok',           # Only set for Cisco messages
    # };
    ...

EXPORT

Exported by default: parse_syslog_line( $one_line_of_syslog_message );

Optional Exports: :preamble preamble_priority preamble_facility

  :constants
       %LOG_FACILITY
       %LOG_PRIORITY

VARIABLES

ExtractProgram

If this variable is set to 1 (the default), parse_syslog_line() will try it's best to extract a "program" field from the input. This is the most expensive set of regex in the module, so if you don't need that pre-parsed, you can speed the module up significantly by setting this variable.

Vendors who do proprietary non-sense with their syslog formats are to blame for this setting.

Usage:

  $Parse::Syslog::Line::ExtractProgram = 0;

DateTimeCreate

If this variable is set to 1 (the default), a DateTime object will be returned in the $m->{datetime_obj} field. Otherwise, this will be skipped.

Usage:

  $Parse::Syslog::Line::DateTimeCreate = 0;

EpochCreate

If this variable is set to 1, the number of seconds from UNIX epoch will be returned in the $m->{epoch} field. If DateTimeCreate is not set, the parser will use HTTP::Date to perform the parsing

Usage:

  $Parse::Syslog::Line::EpochCreate = 1;

PruneRaw

This variable defaults to 0, set to 1 to delete all keys in the return hash ending in "_raw"

Usage:

  $Parse::Syslog::Line::PruneRaw = 1;

PruneEmpty

This variable defaults to 0, set to 1 to delete all keys in the return hash which are undefined.

Usage:

  $Parse::Syslog::Line::PruneEmpty = 1;

PruneFields

This should be an array of fields you'd like to be removed from the hash reference.

Usage:

  @Parse::Syslog::Line::PruneFields = qw(date_raw facility_int priority_int);

RegexSet

Allows the use of different regex sets, the default is stable. This is mostly a developer level feature to allow easy benchmarking of features against previous release.

Usage:

  $Parse::Syslog::Line::RegexSet = 'devel';

FUNCTIONS

parse_syslog_line

Returns a hash reference of syslog message parsed data.

preamble_priority

Takes the Integer portion of the syslog messsage and returns a hash reference as such:

    $prioRef = {
        'preamble'  => 13
        'as_text'   => 'notice',
        'as_int'    => 5,
    };

preamble_facility

Takes the Integer portion of the syslog messsage and returns a hash reference as such:

    $facRef = {
        'preamble'  => 13
        'as_text'   => 'user',
        'as_int'    => 8,
    };

DEVELOPMENT

This module is developed with Dist::Zilla. To build from the repository, use Dist::Zilla:

    dzil authordeps |cpanm
    dzil build
    dzil test

• Github Page

  http://github.com/reyjrar/Parse-Syslog-Line

• AnnoCPAN: Annotated CPAN documentation

  http://annocpan.org/dist/Parse-Syslog-Line

• CPAN Ratings

  http://cpanratings.perl.org/d/Parse-Syslog-Line

• RT: CPAN's request tracker

  http://rt.cpan.org/NoAuth/Bugs.html?Dist=Parse-Syslog-Line

• Search CPAN

  http://search.cpan.org/dist/Parse-Syslog-Line

ACKNOWLEDGEMENTS

Mattia Barbon

Contribution of patch to support faster HTTP::Date routines

Alexander Hartmaier

Contribution of log samples for Cisco devices and testing

Shawn Wilson

Contribution of patch to support custom date parsing function

AUTHOR

Brad Lhotsky <brad@divisionbyzero.net>

COPYRIGHT AND LICENSE

This software is Copyright (c) 2015 by Brad Lhotsky.

This is free software, licensed under:

  The (three-clause) BSD License

cpanm Parse::Syslog::Line

perl -MCPAN -e shell
install Parse::Syslog::Line