influxdata / go-syslog

Blazing fast syslog parser
MIT License
476 stars 69 forks source link

add localetimezone support #32

Closed datastream closed 4 years ago

datastream commented 4 years ago

not all servers' timezone setting is utc.

datastream commented 4 years ago

In my servers , timezone setting is not utc. example: In PST timezone, system print log like this

Nov 22 17:09:42 xxx kernel: [118479565.921459] EXT4-fs warning (device sda8): ext4_dx_add_entry:2006: Directory index full!

If I use default parse, it will convert to utc time 17:09:42. if I use WithTimezone,it will be converted to other. None of them match the real time.

leodido commented 4 years ago

Which would be the "real time"? Can you make a concrete example of the output timestamp you are looking for?

Also, your WithLocaleTimezone option returns the same value WithTimezone option (already existing) returns.

pst, _ := time.LoadLocation("PST")
i := []byte(`<13>Nov 22 17:09:42 xxx kernel: [118479565.921459] EXT4-fs warning (device sda8): ext4_dx_add_entry:2006: Directory index full!`)
p := NewParser(WithLocaleTimezone(pst))
m, _ := p.Parse(i)
// (*rfc3164.SyslogMessage)({
//  Base: (syslog.Base) {
//   Facility: (*uint8)(1),
//   Severity: (*uint8)(5),
//   Priority: (*uint8)(13),
//   Timestamp: (*time.Time)(0000-11-22 17:09:42 +0000 UTC),
//   Hostname: (*string)((len=3) "xxx"),
//   Appname: (*string)((len=6) "kernel"),
//   ProcID: (*string)(<nil>),
//   MsgID: (*string)(<nil>),
//   Message: (*string)((len=95) "[118479565.921459] EXT4-fs warning (device sda8): ext4_dx_add_entry:2006: Directory index full!")
//  }
// })

If you use NewParser(WithTimezone(pst)) you obtain the same output.

datastream commented 4 years ago
package main

import (
        "fmt"
        "github.com/influxdata/go-syslog/v3/rfc3164"
        "time"
)

func main() {
        pst, _ := time.LoadLocation("America/New_York")
        i := []byte(`<13>Nov 22 17:09:42 xxx kernel: [118479565.921459] EXT4-fs warning (device sda8): ext4_dx_add_entry:2006: Directory index full!`)
       // I want Nov 22 17:09:42 in LMT not UTC
        p := rfc3164.NewParser(rfc3164.WithTimezone(pst))
        m, _ := p.Parse(i)
        fmt.Println(m)
        p = rfc3164.NewParser(rfc3164.WithLocaleTimezone(pst))
        m, _ = p.Parse(i)
        fmt.Println(m)
        p = rfc3164.NewParser()
        m, _ = p.Parse(i)
        fmt.Println(m)
}

return

&{{0xc00001408b 0xc00001408c 0xc00001408a 0000-11-22 12:13:40 -0456 LMT 0xc000050200 0xc000050210 <nil> <nil> 0xc000050230}}
&{{0xc0000140d7 0xc0000140d8 0xc0000140d6 0000-11-22 17:09:42 -0456 LMT 0xc000050260 0xc000050270 <nil> <nil> 0xc000050290}}
&{{0xc0000140f7 0xc0000140f8 0xc0000140f6 0000-11-22 17:09:42 +0000 UTC 0xc0000502c0 0xc0000502d0 <nil> <nil> 0xc0000502f0}}

WithTimezone will convert UTC time "0000-11-22 17:09:42 +0000 UTC" to "0000-11-22 12:13:40 -0456 LMT".

leodido commented 4 years ago

Ok @datastream, I updated the Ragel definition, generated the parser from it, updated the docs, and inserted an example for the new WithLocaleTimezone option you proposed.

Can you please double-check now it's behavior is as intended? Thanks!

datastream commented 4 years ago

It looks good to me.