11{
2- "$schema" : " https://lnav.org/schemas/format-v1.schema.json" ,
3- "syslog_log" : {
4- "title" : " Syslog" ,
5- "description" : " The system logger format found on most posix systems." ,
6- "url" : " http://en.wikipedia.org/wiki/Syslog" ,
7- "regex" : {
8- "std" : {
9- "pattern" : " ^(?<timestamp>(?:\\ S{3,8}\\ s+\\ d{1,2} \\ d{2}:\\ d{2}:\\ d{2}|\\ d{4}-\\ d{2}-\\ d{2}T\\ d{2}:\\ d{2}:\\ d{2}(?:\\ .\\ d{3,6})?(?:Z|(?:\\ +|-)\\ d{2}:\\ d{2})))(?: (?<log_hostname>[a-zA-Z0-9:][^ ]+[a-zA-Z0-9]))?(?: \\ [CLOUDINIT\\ ])?(?:(?: syslogd [\\ d\\ .]+|(?: (?<log_syslog_tag>(?<log_procname>(?:[^\\ [: ]+|[^ :]+))(?:\\ [(?<log_pid>\\ d+)\\ ](?: \\ ([^\\ )]+\\ ))?)?))):\\ s*(?<body>.*)$|:?(?:(?: ---)? last message repeated \\ d+ times?(?: ---)?))"
10- },
11- "rfc5424" : {
12- "pattern" : " ^<(?<log_pri>\\ d+)>(?<syslog_version>\\ d+) (?<timestamp>\\ d{4}-\\ d{2}-\\ d{2}T\\ d{2}:\\ d{2}:\\ d{2}(?:\\ .\\ d{6})?(?:[^ ]+)?) (?<log_hostname>[^ ]+|-) (?<log_syslog_tag>(?<log_procname>[^ ]+|-) (?<log_pid>[^ ]+|-) (?<log_msgid>[^ ]+|-)) (?<log_struct>\\ [(?:[^\\ ]\" ]|\" (?:\\ .|[^\" ])+\" )*\\ ]|-|)\\ s+(?<body>.*)"
13- }
14- },
15- "level-field" : " body" ,
16- "level" : {
17- "error" : " (?:(?:(?<![a-zA-Z]))(?:(?i)error(?:s)?)(?:(?![a-zA-Z]))|failed|failure)" ,
18- "warning" : " (?:(?:(?i)warn)|not responding|init: cannot execute)"
19- },
20- "opid-field" : " log_syslog_tag" ,
21- "multiline" : true ,
22- "module-field" : " log_procname" ,
23- "value" : {
24- "log_pri" : {
25- "kind" : " integer" ,
26- "foreign-key" : true ,
27- "description" : " The priority level of the message"
28- },
29- "syslog_version" : {
30- "kind" : " integer" ,
31- "foreign-key" : true ,
32- "description" : " The version of the syslog format used for this message"
33- },
34- "log_hostname" : {
35- "kind" : " string" ,
36- "collate" : " ipaddress" ,
37- "identifier" : true ,
38- "description" : " The name of the host that generated the message"
39- },
40- "log_procname" : {
41- "kind" : " string" ,
42- "identifier" : true ,
43- "description" : " The name of the process that generated the message"
44- },
45- "log_pid" : {
46- "kind" : " string" ,
47- "identifier" : true ,
48- "action-list" : [
49- " dump_pid"
50- ],
51- "description" : " The ID of the process that generated the message"
52- },
53- "log_syslog_tag" : {
54- "kind" : " string" ,
55- "identifier" : true ,
56- "description" : " The combination of the procname and pid"
57- },
58- "log_msgid" : {
59- "kind" : " string" ,
60- "identifier" : true
61- },
62- "log_struct" : {
63- "kind" : " struct"
64- }
65- },
66- "action" : {
67- "dump_pid" : {
68- "label" : " Show Process Info" ,
69- "capture-output" : true ,
70- "cmd" : [
71- " dump-pid.sh"
2+ "$schema" : " https://lnav.org/schemas/format-v1.schema.json" ,
3+ "syslog_log" : {
4+ "title" : " Syslog" ,
5+ "description" : " The system logger format found on most posix systems." ,
6+ "url" : " http://en.wikipedia.org/wiki/Syslog" ,
7+ "regex" : {
8+ "std" : {
9+ "pattern" : " ^(?<timestamp>(?:\\ S{3,8}\\ s+\\ d{1,2} \\ d{2}:\\ d{2}:\\ d{2}|\\ d{4}-\\ d{2}-\\ d{2}T\\ d{2}:\\ d{2}:\\ d{2}(?:\\ .\\ d{3,6})?(?:Z|(?:\\ +|-)\\ d{2}:\\ d{2})))(?: (?<log_hostname>[a-zA-Z0-9:][^ ]+[a-zA-Z0-9]))?(?: \\ [CLOUDINIT\\ ])?(?:(?: syslogd [\\ d\\ .]+|(?: (?<log_syslog_tag>(?<log_procname>(?:[^\\ [:]+|[^ :]+))(?:\\ [(?<log_pid>\\ d+)\\ ](?: \\ ([^\\ )]+\\ ))?)?))):\\ s*(?<body>.*)$|:?(?:(?: ---)? last message repeated \\ d+ times?(?: ---)?))"
10+ },
11+ "rfc5424" : {
12+ "pattern" : " ^<(?<log_pri>\\ d+)>(?<syslog_version>\\ d+) (?<timestamp>\\ d{4}-\\ d{2}-\\ d{2}T\\ d{2}:\\ d{2}:\\ d{2}(?:\\ .\\ d{6})?(?:[^ ]+)?) (?<log_hostname>[^ ]+|-) (?<log_syslog_tag>(?<log_procname>[^ ]+|-) (?<log_pid>[^ ]+|-) (?<log_msgid>[^ ]+|-)) (?<log_struct>\\ [(?:[^\\ ]\" ]|\" (?:\\ .|[^\" ])+\" )*\\ ]|-|)\\ s+(?<body>.*)"
13+ }
14+ },
15+ "level-field" : " body" ,
16+ "level" : {
17+ "error" : " (?:(?:(?<![a-zA-Z]))(?:(?i)error(?:s)?)(?:(?![a-zA-Z]))|failed|failure)" ,
18+ "warning" : " (?:(?:(?i)warn)|not responding|init: cannot execute)"
19+ },
20+ "opid-field" : " log_syslog_tag" ,
21+ "multiline" : true ,
22+ "module-field" : " log_procname" ,
23+ "value" : {
24+ "log_pri" : {
25+ "kind" : " integer" ,
26+ "foreign-key" : true ,
27+ "description" : " The priority level of the message"
28+ },
29+ "syslog_version" : {
30+ "kind" : " integer" ,
31+ "foreign-key" : true ,
32+ "description" : " The version of the syslog format used for this message"
33+ },
34+ "log_hostname" : {
35+ "kind" : " string" ,
36+ "collate" : " ipaddress" ,
37+ "identifier" : true ,
38+ "description" : " The name of the host that generated the message"
39+ },
40+ "log_procname" : {
41+ "kind" : " string" ,
42+ "identifier" : true ,
43+ "description" : " The name of the process that generated the message"
44+ },
45+ "log_pid" : {
46+ "kind" : " string" ,
47+ "identifier" : true ,
48+ "action-list" : [
49+ " dump_pid"
50+ ],
51+ "description" : " The ID of the process that generated the message"
52+ },
53+ "log_syslog_tag" : {
54+ "kind" : " string" ,
55+ "identifier" : true ,
56+ "description" : " The combination of the procname and pid"
57+ },
58+ "log_msgid" : {
59+ "kind" : " string" ,
60+ "identifier" : true
61+ },
62+ "log_struct" : {
63+ "kind" : " struct"
64+ }
65+ },
66+ "action" : {
67+ "dump_pid" : {
68+ "label" : " Show Process Info" ,
69+ "capture-output" : true ,
70+ "cmd" : [
71+ " dump-pid.sh"
72+ ]
73+ }
74+ },
75+ "sample" : [
76+ {
77+ "line" : " Apr 28 04:02:03 tstack-centos5 syslogd 1.4.1: restart."
78+ },
79+ {
80+ "line" : " Jun 27 01:47:20 Tims-MacBook-Air.local configd[17]: network changed: v4(en0-:192.168.1.8) DNS- Proxy- SMB"
81+ },
82+ {
83+ "line" : " Jun 20 17:26:13 ip-10-188-149-5 [CLOUDINIT] util.py[DEBUG]: Restoring selinux mode for /var/lib/cloud (recursive=False)"
84+ },
85+ {
86+ "line" : " <46>1 2017-04-27T07:50:47.381967+02:00 logserver rsyslogd - - [origin software=\" rsyslogd\" swVersion=\" 8.4.2\" x-pid=\" 900\" x-info=\" http://www.rsyslog.com\" ] start"
87+ },
88+ {
89+ "line" : " <30>1 2017-04-27T07:59:12+02:00 nextcloud dhclient - - - DHCPREQUEST on eth0 to 192.168.1.1 port 67"
90+ },
91+ {
92+ "line" : " <78>1 2017-04-27T08:09:01+02:00 nextcloud CRON 1472 - - (root) CMD ( [ -x /usr/lib/php5/sessionclean ] && /usr/lib/php5/sessionclean)"
93+ },
94+ {
95+ "line" : " Aug 1 00:00:03 Tim-Stacks-iMac com.apple.xpc.launchd[1] (com.apple.mdworker.shared.0C000000-0700-0000-0000-000000000000[50989]): Service exited due to SIGKILL | sent by mds[198]"
96+ },
97+ {
98+ "line" : " Jan 4 10:23:26 Tims-MacBook-Air Setup Assistant[1173]: Creating connection"
99+ }
72100 ]
73- }
74- },
75- "sample" : [
76- {
77- "line" : " Apr 28 04:02:03 tstack-centos5 syslogd 1.4.1: restart."
78- },
79- {
80- "line" : " Jun 27 01:47:20 Tims-MacBook-Air.local configd[17]: network changed: v4(en0-:192.168.1.8) DNS- Proxy- SMB"
81- },
82- {
83- "line" : " Jun 20 17:26:13 ip-10-188-149-5 [CLOUDINIT] util.py[DEBUG]: Restoring selinux mode for /var/lib/cloud (recursive=False)"
84- },
85- {
86- "line" : " <46>1 2017-04-27T07:50:47.381967+02:00 logserver rsyslogd - - [origin software=\" rsyslogd\" swVersion=\" 8.4.2\" x-pid=\" 900\" x-info=\" http://www.rsyslog.com\" ] start"
87- },
88- {
89- "line" : " <30>1 2017-04-27T07:59:12+02:00 nextcloud dhclient - - - DHCPREQUEST on eth0 to 192.168.1.1 port 67"
90- },
91- {
92- "line" : " <78>1 2017-04-27T08:09:01+02:00 nextcloud CRON 1472 - - (root) CMD ( [ -x /usr/lib/php5/sessionclean ] && /usr/lib/php5/sessionclean)"
93- },
94- {
95- "line" : " Aug 1 00:00:03 Tim-Stacks-iMac com.apple.xpc.launchd[1] (com.apple.mdworker.shared.0C000000-0700-0000-0000-000000000000[50989]): Service exited due to SIGKILL | sent by mds[198]"
96- }
97- ]
98- }
101+ }
99102}
0 commit comments