Package ZenEvents :: Module SyslogProcessing :: Class SyslogProcessor

Class SyslogProcessor

object --+
         |
        SyslogProcessor

Instance Methods

[hide private]

__init__(self, zem, minpriority, parsehost)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature

source code

process(self, msg, ipaddr, host, rtime)

source code

parsePRI(self, evt, msg)
Parse RFC-3164 PRI part of syslog message to get facility and priority.

source code

defaultSeverityMap(self, pri)
Default mapping from syslog priority to severity.

source code

timeParse(...)
search(string[, pos[, endpos]]) --> match object or None.

source code

notHostSearch(...)
search(string[, pos[, endpos]]) --> match object or None.

source code

parseHEADER(self, evt, msg)
Parse RFC-3164 HEADER part of syslog message.

source code

parseTag(self, evt, msg)
Parse the RFC-3164 tag of the syslog message using the regex defined at the top of this module.

source code

buildEventClassKey(self, evt)
Build the key used to find an events dictionary record.

source code

Inherited from object: __delattr__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __str__

Properties

[hide private]

Inherited from object: __class__

Method Details

[hide private]

init(self, zem, minpriority, parsehost)
(Constructor)

source code

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Overrides: object.__init__: (inherited documentation)

timeParse(...)

source code

search(string[, pos[, endpos]]) --> match object or None. Scan through string looking for a match, and return a corresponding MatchObject instance. Return None if no position in the string matches.

notHostSearch(...)

source code

search(string[, pos[, endpos]]) --> match object or None. Scan through string looking for a match, and return a corresponding MatchObject instance. Return None if no position in the string matches.

parseHEADER(self, evt, msg)

source code

Parse RFC-3164 HEADER part of syslog message. TIMESTAMP format is: MMM HH:MM:SS and host is next token without the characters '[' or ':'.

buildEventClassKey(self, evt)

source code

Build the key used to find an events dictionary record. If eventClass is defined it is used. For NT events "Source_Evid" is used. For other syslog events we use the summary of the event to perform a full text or'ed search.

Class SyslogProcessor

__init__(self, zem, minpriority, parsehost) (Constructor)

timeParse(...)

notHostSearch(...)

parseHEADER(self, evt, msg)

buildEventClassKey(self, evt)

init(self, zem, minpriority, parsehost)
(Constructor)