Exilog ( v 0.2 ) has trouble with exim logfiles written with
"log_timezone = true". Here's a patch which expands
the timestamp parsing to permit both variants.
(Why yes, I do prefer logfiles to be in UTC. Why d'you ask? :-)
Cheers,
Jeremy
Index: exilog_util.pm
===================================================================
--- exilog_util.pm (revision 1022)
+++ exilog_util.pm (working copy)
@@ -82,10 +82,23 @@
my $date = shift || "";
my $tod = shift || "00:00:00";
my ($year,$month,$mday) = split /\-/, $date;
- my ($hour,$minute,$second) = split /\:/, $tod;
+ my ($hour,$minute,$second,$junk) = split /[: ]/, $tod;
$year-=1900;
$month--;
- return strftime("%s",$second,$minute,$hour,$mday,$month,$year);
+ return strftime("%s",$second,$minute,$hour,$mday,$month,$year)
+ if ( $junk eq "" );
+
+ my $hoff = ($junk =~ /[-+](\d\d)\d\d/);
+ my $moff = ($junk =~ /[-+]\d\d(\d\d)/);
+ if ($junk =~ /\+/) {
+ $hour = $hour - $hoff;
+ $minute = $minute - $moff;
+ } else {
+ $hour = $hour + $hoff;
+ $minute = $minute + $moff;
+ }
+ return strftime("%s",$second,$minute,$hour,$mday,$month,$year,-1,-1,0);
+
};
Index: exilog_parse.pm
===================================================================
--- exilog_parse.pm (revision 1022)
+++ exilog_parse.pm (working copy)
@@ -256,8 +256,8 @@
# and one with message ID (post-DATA). Try the latter first.
m/()()()()/;
- $subj =~ m/([0-9]{4}\-[0-9]{2}\-[0-9]{2}) ([0-9]{2}\:[0-9]{2}\:[0-9]{2}) ([A-Za-z0-9]{6}\-[A-Za-z0-9]{6}\-[A-Za-z0-9]{2}) (H\=.*)$/;
- my ($date,$tod,$msgid,$line) = ($1,$2,$3,$4);
+ $subj =~ m/(\d{4}-\d\d-\d\d) (\d\d:\d\d:\d\d( [-+]\d{4})?) ([A-Za-z0-9]{6}-[A-Za-z0-9]{6}-[A-Za-z0-9]{2}) (H=.*)$/;
+ my ($date,$tod,$msgid,$line) = ($1,$2,$4,$5);
if ($date && $tod && $msgid && $line) {
# line with message id
$h->{data}->{message_id} = $msgid;
@@ -265,8 +265,8 @@
else {
# try format without message id
m/()()()()/;
- $subj =~ m/([0-9]{4}\-[0-9]{2}\-[0-9]{2}) ([0-9]{2}\:[0-9]{2}\:[0-9]{2}) (H\=.*)$/;
- ($date,$tod,$line) = ($1,$2,$3);
+ $subj =~ m/(\d{4}-\d\d-\d\d) (\d\d:\d\d:\d\d( [-+]\d{4})?) (H=.*)$/;
+ ($date,$tod,$line) = ($1,$2,$4);
unless ($date && $tod && $line) {
# unparsable
return 0;
@@ -293,8 +293,8 @@
return 0 if ($subj =~ /retry time not reached for any host$/);
# Grab date, time and message id
- $subj =~ m/([0-9]{4}\-[0-9]{2}\-[0-9]{2}) ([0-9]{2}\:[0-9]{2}\:[0-9]{2}) ([A-Za-z0-9]{6}\-[A-Za-z0-9]{6}\-[A-Za-z0-9]{2}) (([^ ]+).*)$/;
- my ($date,$tod,$msgid,$line,$type) = ($1,$2,$3,$4,$5);
+ $subj =~ m/(\d{4}-\d\d-\d\d) (\d\d:\d\d:\d\d( [-+]\d{4})?) ([A-Za-z0-9]{6}-[A-Za-z0-9]{6}-[A-Za-z0-9]{2}) (([^ ]+).*)$/;
+ my ($date,$tod,$msgid,$line,$type) = ($1,$2,$4,$5,$6);
$line =~ s/^ +// if (defined($line));
unless ($date && $tod && $msgid && $line && $type) {
# non-message based line
@@ -302,8 +302,8 @@
};
# removed fttb, too much overhead
- #my $h = { 'data' => { 'line' => $line, 'message_id' => $3 } };
- my $h = { 'data' => { 'message_id' => $3 } };
+ #my $h = { 'data' => { 'line' => $line, 'message_id' => $msgid } };
+ my $h = { 'data' => { 'message_id' => $msgid } };
if ($type eq '<=') {