From 71d88d6975374a3e23183c1e9de3c074f0920be2 Mon Sep 17 00:00:00 2001 From: Tony Murray Date: Sat, 27 Feb 2016 16:00:06 -0600 Subject: [PATCH] This should process all of the messages on these sites and if it fails, there should be no data loss http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/29804-186.html http://www.cisco.com/c/en/us/td/docs/ios/system/messages/guide/consol_smg/sm_cnovr.html --- includes/syslog.php | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/includes/syslog.php b/includes/syslog.php index 7952a50ab..8d6a902c4 100644 --- a/includes/syslog.php +++ b/includes/syslog.php @@ -52,17 +52,26 @@ function process_syslog($entry, $update) { $os = get_cache($entry['host'], 'os'); if (in_array($os, array('ios', 'iosxe', 'catos'))) { - $matches = array(); - /* Split the following examples, or fallback to leaving everything in msg - * %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to up - * %SYS-5-MOD_OK:Module 1 is online - */ - if (preg_match('/^%([A-Z\d\-_]+): ?(.+)/', $entry['msg'], $matches)) { - $entry['program'] = $matches[1]; - $entry['msg'] = $matches[2]; + // multipart message + if(strpos($entry['msg'], ':') !== false) { + /* Split the following examples + * %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text + * %FACILITY-SUBFACILITY-SEVERITY-MNEMONIC: Message-text + */ + $matches = array(); + if(preg_match('/^%?(?[A-Za-z\d\-_]+(:[A-Z]* %[A-Z\d\-_]+)?): ?(?.*)/', $entry['msg'], $matches)) { + $entry['program'] = $matches['program']; + $entry['msg'] = $matches['msg']; + } + unset($matches); + } + else { + // if this looks like a program (no groups of 2 or more lowercase letters), move it to program + if (preg_match('/[^(a-z)]{2,}/', $entry['msg'])) { + $entry['program'] = $entry['msg']; + unset($entry['msg']); + } } - - unset($matches); } else if ($os == 'linux' and get_cache($entry['host'], 'version') == 'Point') { // Cisco WAP200 and similar