Some devices have "logging timestamp" enabled, try to remove that from the start of the message.

Fixes #3199
This commit is contained in:
Tony Murray
2016-03-09 08:20:51 -06:00
parent 6199d36936
commit bca965e2ae
2 changed files with 12 additions and 5 deletions
+4 -5
View File
@@ -54,12 +54,11 @@ function process_syslog($entry, $update) {
if (in_array($os, array('ios', 'iosxe', 'catos'))) {
// multipart message
if(strpos($entry['msg'], ':') !== false) {
/* Split the following examples
* %CARD-SEVERITY-MSG:SLOT %FACILITY-SEVERITY-MNEMONIC: Message-text
* %FACILITY-SUBFACILITY-SEVERITY-MNEMONIC: Message-text
*/
$matches = array();
if(preg_match('/^(?<program>%?[A-Za-z\d\-_]+(:[A-Z]* %[A-Z\d\-_]+)?): ?(?<msg>.*)/', $entry['msg'], $matches)) {
$timestamp_prefix = '([A-Z][a-z]{2} \d\d? \d\d:\d\d:\d\d(.\d\d\d [A-Z]{3})?: )?';
$program_match = '(?<program>%?[A-Za-z\d\-_]+(:[A-Z]* %[A-Z\d\-_]+)?)';
$message_match = '(?<msg>.*)';
if(preg_match('/^' . $timestamp_prefix . $program_match . ': ?' . $message_match . '/', $entry['msg'], $matches)) {
$entry['program'] = $matches['program'];
$entry['msg'] = $matches['msg'];
}