Package ZenEvents :: Module SyslogProcessing :: Class SyslogProcessor
[hide private]
[frames] | no frames]

Class SyslogProcessor

source code

object --+
         |
        SyslogProcessor

Instance Methods [hide private]
 
__init__(self, zem, minpriority, parsehost)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature
source code
 
process(self, msg, ipaddr, host, rtime) source code
 
parsePRI(self, evt, msg)
Parse RFC-3164 PRI part of syslog message to get facility and priority.
source code
 
defaultSeverityMap(self, pri)
Default mapping from syslog priority to severity.
source code
 
timeParse(...)
search(string[, pos[, endpos]]) --> match object or None.
source code
 
notHostSearch(...)
search(string[, pos[, endpos]]) --> match object or None.
source code
 
parseHEADER(self, evt, msg)
Parse RFC-3164 HEADER part of syslog message.
source code
 
parseTag(self, evt, msg)
Parse the RFC-3164 tag of the syslog message using the regex defined at the top of this module.
source code
 
buildEventClassKey(self, evt)
Build the key used to find an events dictionary record.
source code

Inherited from object: __delattr__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __str__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(self, zem, minpriority, parsehost)
(Constructor)

source code 
x.__init__(...) initializes x; see x.__class__.__doc__ for signature
Overrides: object.__init__
(inherited documentation)

timeParse(...)

source code 
search(string[, pos[, endpos]]) --> match object or None. Scan through string looking for a match, and return a corresponding MatchObject instance. Return None if no position in the string matches.

notHostSearch(...)

source code 
search(string[, pos[, endpos]]) --> match object or None. Scan through string looking for a match, and return a corresponding MatchObject instance. Return None if no position in the string matches.

parseHEADER(self, evt, msg)

source code 
Parse RFC-3164 HEADER part of syslog message. TIMESTAMP format is: MMM HH:MM:SS and host is next token without the characters '[' or ':'.

buildEventClassKey(self, evt)

source code 
Build the key used to find an events dictionary record. If eventClass is defined it is used. For NT events "Source_Evid" is used. For other syslog events we use the summary of the event to perform a full text or'ed search.