Handle syslog messages per RFC3164 section 4.3.2

Author: Xiol

rfc3164/rfc3164.go

@@ -2,8 +2,9 @@ package rfc3164
 
 import (
 	"bytes"
-	"github.com/Xiol/syslogparser"
 	"time"
+
+	"github.com/Xiol/syslogparser"
 )
 
 type Parser struct {
@@ -15,6 +16,7 @@ type Parser struct {
 	header   header
 	message  rfc3164message
 	location *time.Location
+	skipTag  bool
 }
 
 type header struct {
@@ -46,13 +48,21 @@ func (p *Parser) Parse() error {
 		return err
 	}
 
+	tcursor := p.cursor
 	hdr, err := p.parseHeader()
-	if err != nil {
+	if err == syslogparser.ErrTimestampUnknownFormat {
+		// RFC3164 sec 4.3.2.
+		hdr.timestamp = time.Now().Round(time.Second)
+		// No tag processing should be done
+		p.skipTag = true
+		// Reset cursor for content read
+		p.cursor = tcursor
+	} else if err != nil {
 		return err
+	} else {
+		p.cursor++
 	}
 
-	p.cursor++
-
 	msg, err := p.parsemessage()
 	if err != syslogparser.ErrEOL {
 		return err
@@ -106,17 +116,19 @@ func (p *Parser) parsemessage() (rfc3164message, error) {
 	msg := rfc3164message{}
 	var err error
 
-	tag, err := p.parseTag()
-	if err != nil {
-		return msg, err
+	if !p.skipTag {
+		tag, err := p.parseTag()
+		if err != nil {
+			return msg, err
+		}
+		msg.tag = tag
 	}
 
 	content, err := p.parseContent()
 	if err != syslogparser.ErrEOL {
 		return msg, err
 	}
 
-	msg.tag = tag
 	msg.content = content
 
 	return msg, err

rfc3164/rfc3164_test.go

@@ -87,6 +87,40 @@ func (s *Rfc3164TestSuite) TestParser_ValidNoTag(c *C) {
 	c.Assert(obtained, DeepEquals, expected)
 }
 
+// RFC 3164 section 4.3.2
+func (s *Rfc3164TestSuite) TestParser_NoTimestamp(c *C) {
+	buff := []byte("<14>INFO     leaving (1) step postscripts")
+
+	p := NewParser(buff)
+	expectedP := &Parser{
+		buff:     buff,
+		cursor:   0,
+		l:        len(buff),
+		location: time.UTC,
+	}
+
+	c.Assert(p, DeepEquals, expectedP)
+
+	err := p.Parse()
+	c.Assert(err, IsNil)
+
+	now := time.Now()
+
+	obtained := p.Dump()
+	obtained["timestamp"] = now // XXX: Need to mock out time to test this fully
+	expected := syslogparser.LogParts{
+		"timestamp": now,
+		"hostname":  "",
+		"tag":       "",
+		"content":   "INFO     leaving (1) step postscripts",
+		"priority":  14,
+		"facility":  1,
+		"severity":  6,
+	}
+
+	c.Assert(obtained, DeepEquals, expected)
+}
+
 func (s *Rfc3164TestSuite) TestParseHeader_Valid(c *C) {
 	buff := []byte("Oct 11 22:14:15 mymachine ")
 	now := time.Now()