| Subject: | Support for '-- Mark --' messages |
| Date: | Fri, 9 Jul 2010 20:01:41 +0100 |
| To: | <bug-Parse-Syslog [...] rt.cpan.org> |
| From: | "Aidan Kissane" <aidan_kissane [...] hotmail.com> |
Hi,
This is not so much a bug report as more of a feature request.
Version 1.10 of Parse::Syslog skips '-- Mark --' messages without giving the
script that uses the module a choice. Maybe a better option with be to not
ignore the mark message but give the script using the module the option of
whiter to act on it or not. I have made my own version of Parse::Syslog
which works quite well and maybe this solution could be implemented in the
module. I have changed the following lines:
.
.
# marks
next if $text eq '-- MARK --';
# some systems send over the network their
# hostname prefixed to the text. strip that.
$text =~ s/^$host\s+//;
.
.
to:
.
.
.
# marks
if ($text eq '-- MARK --') {
if($self->{arrayref}) {
$self->{_last_data}{$host} = [
$time, # 0: timestamp
$host, # 1: host
$text, # 2: mark
];
}
else {
$self->{_last_data}{$host} = {
timestamp => $time,
host => $host,
mark => $text,
};
}
}
else {
# some systems send over the network their
# hostname prefixed to the text. strip that.
$text =~ s/^$host\s+//;
.
.
Then in the script that uses Parse::Syslog I can choose whether to act on
mark messages or not:
.
.
.
my $syslogparser = Parse::Syslog->new( File::Tail->new($syslogfile), type =>
"syslog" );
while ($syslogmsg = $syslogparser->next) {
next if ( $syslogmsg->{mark} ); # Skip message if it is a mark
.
.
}
Or by checking if 3rd element in array eq '-- Mark --'.