tstack / lnav

Log file navigator
http://lnav.org
BSD 2-Clause "Simplified" License
7.7k stars 305 forks source link

bug in tcsh_history? #370

Open aspiers opened 7 years ago

aspiers commented 7 years ago

The default tcsh_history format has:

            "pattern" : "^#(?<timestamp>\\+\\d+)\\n?(?<body>.*)?$"

Why is the + character inside the <timestamp> capture field? What is also strange is that when I move it outside, so that the pattern begins with ^#\\+, I get:

$ lnav ~/.history
error:tcsh_history:invalid sample -- #+1375138067
echo HELLO=BAR
error:tcsh_history:unrecognized timestamp format -- 1375138067
echo HELLO=BAR
  format: @%@; matched:
  format: %Y-%m-%d %H:%M:%S; matched: 1375
  format: %Y-%m-%d %H:%M; matched: 1375
  format: %Y-%m-%dT%H:%M:%S.%f%z; matched: 1375
  format: %y-%m-%dT%H:%M:%S.%f%z; matched: 13
  format: %Y-%m-%dT%H:%M:%SZ; matched: 1375
  format: %Y-%m-%dT%H:%M:%S; matched: 1375
  format: %Y/%m/%d %H:%M:%S; matched: 1375
  format: %Y/%m/%d %H:%M; matched: 1375
  format: %a %b %d %H:%M:%S %Y; matched: 1375138067
  format: %a %b %d %H:%M:%S %Z %Y; matched: 1375138067
  format: %a %b %d %H:%M:%S ; matched: 1375138067
  format: %a %b %d %H:%M:%S.%L ; matched: 1375138067
  format: %d/%b/%Y:%H:%M:%S +0000; matched: 13
  format: %d/%b/%Y:%H:%M:%S %z; matched: 13
  format: %b %d %H:%M:%S; matched:
  format: %b %d %k:%M:%S; matched:
  format: %b %d %l:%M:%S; matched:
  format: %b %e, %Y %l:%M:%S %p; matched:
  format: %m/%d/%y %H:%M:%S; matched: 13
  format: %m/%d/%Y %I:%M:%S:%L %p %Z; matched: 13
  format: %m/%e/%Y %l:%M:%S %p; matched: 13
  format: %m%d %H:%M:%S; matched: 13
  format: %H:%M:%S; matched: 13
  format: %M:%S; matched: 13
  format: %m/%d %H:%M:%S; matched: 13
  format: %Y-%m-%d; matched: 1375
  format: %Y-%m; matched: 1375
  format: %Y/%m/%d; matched: 1375
  format: %Y/%m; matched: 1375

This can be fixed by adding

    "timestamp-format" : [
        "%s"
    ],

Why is +1375138067 recognised as a valid timestamp by default but 1375138067 isn't?

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/39382840-bug-in-tcsh_history?utm_campaign=plugin&utm_content=tracker%2F449456&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F449456&utm_medium=issues&utm_source=github).
aspiers commented 7 years ago

Hmm, I thought I'd found the answer to this in src/lnav_util.cc:

const char *std_time_fmt[] = {
    [snipped]

    "+%s",

    NULL,
};

but it actually appears that nothing uses std_time_fmt?

Maybe it's instead explained by this part of date_time_scanner::scan()?

    if (time_dest[0] == '+') {
        char time_cp[time_len + 1];
        int gmt_int, off;

        retval = NULL;
        memcpy(time_cp, time_dest, time_len);
        time_cp[time_len] = '\0';
        if (sscanf(time_cp, "+%d%n", &gmt_int, &off) == 1) {
tstack commented 7 years ago

Yes, it's the date_time_scanner that looks for the plus and does a hardcoded parse. Probably old code that should be updated at some point here.