Another test case for the cisco syslog timestamp prefix.

This commit is contained in:
Tony Murray
2016-03-09 10:49:12 -06:00
parent 33c4cca8a4
commit d59fc01b61
2 changed files with 5 additions and 1 deletions
+1 -1
View File
@@ -55,7 +55,7 @@ function process_syslog($entry, $update) {
// multipart message
if(strpos($entry['msg'], ':') !== false) {
$matches = array();
$timestamp_prefix = '([A-Z][a-z]{2} \d\d? \d\d:\d\d:\d\d(.\d\d\d [A-Z]{3})?: )?';
$timestamp_prefix = '([A-Z][a-z]{2} \d\d? \d\d:\d\d:\d\d(.\d\d\d)?( [A-Z]{3})?: )?';
$program_match = '(?<program>%?[A-Za-z\d\-_]+(:[A-Z]* %[A-Z\d\-_]+)?)';
$message_match = '(?<msg>.*)';
if(preg_match('/^' . $timestamp_prefix . $program_match . ': ?' . $message_match . '/', $entry['msg'], $matches)) {