ZenEvent.SyslogProcessing.notHostSearch regex fails on valid hostname characters

[zenoss]

Symptom: zensyslog --parsehost fails to parse hostnames with embedded '-' characters, which is a legal DNS hostname character. When forwarding syslog messages from an existing central collector (e.g. syslog-ng), this causes syslog events to be associated with the wrong devices.

Cause: ZenEvent.SyslogProcessing.notHostSearch matches on "[-[:]", but '-' is a valid hostname character.

What's the reason for not simply using msglist[0]?

(Apologies if I chose the wrong priority/severity but I couldn't find any explanation of how you're using them.)

--
David Carmean
dlc@…

[zenoss]

Here's a patch:

*** SyslogProcessing.py.orig 2007-09-21 05:35:26.000000000 -0700
--- SyslogProcessing.py 2007-10-26 14:02:44.000000000 -0700
***************
*** 128,134 ****

timeParse =

re.compile("^{(S{3} [d ]{2} [d ]{2}:[d ]{2}:[d ]{2}) (.*)").search}

! notHostSearch = re.compile("[-[:]").search

def parseHEADER(self, evt, msg):

"""Parse RFC-3164 HEADER part of syslog message. TIMESTAMP format is:
MMM HH:MM:SS and host is next token without the characters '[' or ':'.

--- 128,134 ----

timeParse =

re.compile("^{(S{3} [d ]{2} [d ]{2}:[d ]{2}:[d ]{2}) (.*)").search}

! notHostSearch = re.compile("[[:]").search

def parseHEADER(self, evt, msg):

"""Parse RFC-3164 HEADER part of syslog message. TIMESTAMP format is:
MMM HH:MM:SS and host is next token without the characters '[' or ':'.

[zenoss]

Let's try that again:

*** SyslogProcessing.py.dist    2007-09-21 05:35:26.000000000 -0700
--- SyslogProcessing.py 2007-10-26 14:02:44.000000000 -0700
***************
*** 128,134 ****
  
      timeParse = 
          re.compile("^(S{3} [d ]{2} [d ]{2}:[d ]{2}:[d ]{2}) (.*)").search
!     notHostSearch = re.compile("[-[:]").search
      def parseHEADER(self, evt, msg):
          """Parse RFC-3164 HEADER part of syslog message.  TIMESTAMP format is:
          MMM HH:MM:SS and host is next token without the characters '[' or ':'.
--- 128,134 ----
  
      timeParse = 
          re.compile("^(S{3} [d ]{2} [d ]{2}:[d ]{2}:[d ]{2}) (.*)").search
!     notHostSearch = re.compile("[[:]").search
      def parseHEADER(self, evt, msg):
          """Parse RFC-3164 HEADER part of syslog message.  TIMESTAMP format is:
          MMM HH:MM:SS and host is next token without the characters '[' or ':'.

[cluther]

(In [7323]) * Refs #1913.

[marc]

(In [7433]) Patching r7323 to 2.1.x branch

• refs #1913