Fix GNU syslog (#63)

* some tests for rfc3164: GNU is failing!

* rfc3164 is now compatible with GNU syslog()

* add a test case for PID in "normal" 3164 format

Author: boyska

format/rfc3164_test.go

@@ -8,3 +8,57 @@ func (s *FormatSuite) TestRFC3164_SingleSplit(c *C) {
 	f := RFC3164{}
 	c.Assert(f.GetSplitFunc(), IsNil)
 }
+
+func (s *FormatSuite) TestRFC3164_CorrectParsingTypical(c *C) {
+	f := RFC3164{}
+
+	find := `<13>May  1 20:51:40 myhostname myprogram: ciao`
+	parser := f.GetParser([]byte(find))
+	err := parser.Parse()
+	c.Assert(err, IsNil)
+	c.Assert(parser.Dump()["content"], Equals, "ciao")
+	c.Assert(parser.Dump()["hostname"], Equals, "myhostname")
+	c.Assert(parser.Dump()["tag"], Equals, "myprogram")
+
+}
+func (s *FormatSuite) TestRFC3164_CorrectParsingTypicalWithPID(c *C) {
+	f := RFC3164{}
+
+	find := `<13>May  1 20:51:40 myhostname myprogram[42]: ciao`
+	parser := f.GetParser([]byte(find))
+	err := parser.Parse()
+	c.Assert(err, IsNil)
+	c.Assert(parser.Dump()["content"], Equals, "ciao")
+	c.Assert(parser.Dump()["hostname"], Equals, "myhostname")
+	c.Assert(parser.Dump()["tag"], Equals, "myprogram")
+
+}
+
+func (s *FormatSuite) TestRFC3164_CorrectParsingGNU(c *C) {
+	// GNU implementation of syslog() has a variant: hostname is missing
+	f := RFC3164{}
+
+	find := `<13>May  1 20:51:40 myprogram: ciao`
+	parser := f.GetParser([]byte(find))
+	err := parser.Parse()
+	c.Assert(err, IsNil)
+	c.Assert(parser.Dump()["content"], Equals, "ciao")
+	// c.Assert(parser.Dump()["hostname"], Equals, "myhostname")
+	c.Assert(parser.Dump()["tag"], Equals, "myprogram")
+
+}
+
+func (s *FormatSuite) TestRFC3164_CorrectParsingJournald(c *C) {
+	// GNU implementation of syslog() has a variant: hostname is missing
+	// systemd uses it, and typically also passes PID
+	f := RFC3164{}
+
+	find := `<78>May  1 20:51:02 myprog[153]: blah`
+	parser := f.GetParser([]byte(find))
+	err := parser.Parse()
+	c.Assert(err, IsNil)
+	c.Assert(parser.Dump()["content"], Equals, "blah")
+	// c.Assert(parser.Dump()["hostname"], Equals, "myhostname")
+	c.Assert(parser.Dump()["tag"], Equals, "myprog")
+
+}

internal/syslogparser/rfc3164/rfc3164.go

@@ -2,6 +2,7 @@ package rfc3164
 
 import (
 	"bytes"
+	"os"
 	"time"
 
 	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser"
@@ -194,7 +195,17 @@ func (p *Parser) parseTimestamp() (time.Time, error) {
 }
 
 func (p *Parser) parseHostname() (string, error) {
-	return syslogparser.ParseHostname(p.buff, &p.cursor, p.l)
+	oldcursor := p.cursor
+	hostname, err := syslogparser.ParseHostname(p.buff, &p.cursor, p.l)
+	if err == nil && len(hostname) > 0 && string(hostname[len(hostname)-1]) == ":" { // not an hostname! we found a GNU implementation of syslog()
+		p.cursor = oldcursor - 1
+		myhostname, err := os.Hostname()
+		if err == nil {
+			return myhostname, nil
+		}
+		return "", nil
+	}
+	return hostname, err
 }
 
 // http://tools.ietf.org/html/rfc3164#section-4.1.3