Syslog(3pm)

📦 version 2.1.1, in arch rolling

💖 Lire::Syslog — syslog style lines parser 💖

okay bestie, so this is the Syslog(3pm) page from LogReport's Lire Documentation — it's Lire::Syslog, and it's literally the little parser that eats syslog lines for breakfast and hands you back a cute lil hash. let's get into it 🫶

✨ SYNOPSIS ✨

use Lire::Syslog;

my $parser = new Lire::Syslog;

my $rec = $parser->parse( $line );

that's it. that's the whole vibe check. 💅

🌸 DESCRIPTION 🌸

so this module defines objects that are able to parse logs coming from several flavours of logging daemon. like, not just one. multiple. it's giving versatility, honestly.

right now it supports the following syslog file formats:

💜 Classic BSD syslog daemon

the "classic" BSD syslog format, no cap:

MMM DD HH:MM:SS Hostname Message

🔥 Solaris 8 syslog daemon

the Solaris 8 syslog daemon also includes the facility and level, bc it's extra like that:

MMM DD HH:MM:SS Hostname Process[Pid]: [ID DDDDDD Facility.Level] Message

🎀 Netscape Messaging Server logging daemon

the syslog daemon that comes with Netscape Messaging Server uses a date in common log format:

[DD/MMM/YYYY:HH:MM:SS +ZZZZ] Hostname Process[Pid]: Facility Level: Message

🦋 WebTrends syslog daemon

the format used by the syslog daemon that comes with WebTrends:

WTsyslog[YYYY-MM-DD HH:MM:SS ip=HOSTNAME pri=WT_PRIORITY] <XX>Message

⭐ Kiwi Syslog (ISO date format)

the ISO log file formats used by the Kiwi Syslog daemon (http://www.kiwisyslog.com/info_sysd.htm) — and yes, that's a logging daemon often encountered on Win32 platforms:

YYYY-MM-DD HH:MM:SS [TAB] Facility.Level [TAB] Hostname [TAB] Message

🌈 Kiwi Syslog (US date format)

the US date format used by the Kiwi Syslog daemon:

MM-DD-YYYY HH:MM:SS [TAB] Facility.Level [TAB] Hostname [TAB] Message

🍓 Kiwi Syslog (DD-MM-YYY date format)

the DD-MM-YYYY date format used by the Kiwi Syslog daemon:

DD-MM-YYYY HH:MM:SS [TAB] Facility.Level [TAB] Hostname [TAB] Message

👑 Sendmail Switch logging daemon

the format used by the logging daemon coming with Sendmail Switch on Win32 platforms:

MM/DD/YY HH:MM:SS Process(Pid): Level: Message

🧚 RFC 3164-compliant Syslog daemon

a format from RFC 3164-compliant Syslog daemons which includes the encoded priority and the year in the date. RFC 3164 defines the "BSD Syslog Protocol", iykyk:

<Priority>MMM DD YYYY HH:MM:SS: Process[Pid]: Message

so here's the tea ☕ — the first time the parse() method is used, the parser will try each of the supported formats to detect the syslog format. and like, if no format matches? the module will call lr_err() and abort the program. so dramatic. 😭 each other parse() invocation will use the same format, so it only does the detective work once.

the parse() method will return a hash reference which contains the following keys:

  • timestamp — the timestamp of the event.
  • hostname — the name or IP address of the host that sended the message.
  • process — the "process" that logged the event. formally, the syslog message doesn't contain a process field, but its usually the first word coming before a colon in the message's content.
  • pid — the PID of the process that logged the event. this is usually what is between [] in the process part of the message.
  • identifier — this key is only present when the log comes from a Solaris 8 syslog daemon. it contains the identifier that comes after ID in the message.
  • facility — the syslog facility (kern, mail, local0, etc.) of the message. this isn't supported in all file formats so this key might be unavailable. 🙈
  • level — the syslog level (emerg, info, notice, etc. ) of the message. this isn't supported in all file formats so this key might be unavailable too.
  • content — the actual syslog message (with the process and pid removed). many network devices will also have another BSD-style timestamp at the beginning of the message. if present, it will also be removed. slay.

🎀 USAGE 🎀

okay so you wanna subclass it? periodt. here's how:

 package Lire::Foo;

 use base qw/ Lire::Syslog /;

 sub parse {
    my $self = shift;
    my $line = shift;

    # this runs parse from Lire::Syslog, setting keys like 'day', 'process'
    # and 'hostname'
    my $rec = $self->SUPER::parse($line);

    $rec->{'foo'} = dosomethingwith( $rec->{'content'} );

    return $rec
 }

now, one can run in a script:

 my $parser = new Lire::Foo();

 while ( <> ) {
    chomp;
    my $log = $parser->parse( $line );
 }

which sets $log->{'day'}, ... $log->{'process'} and $log->{'foo'}. iconic. your hash is fully furnished now. 🏠✨

🦋 SEE ALSO 🦋

  • Lire::Email(3)

💜 AUTHORS 💜

  • Joost van Baal, Francis J. Lacoste. initial idea by Joost Kooij

⭐ VERSION ⭐

$Id: Syslog.pm,v 1.15 2006/07/23 13:16:30 vanbaal Exp $

Copyright (C) 2000-2002 Stichting LogReport Foundation LogReport@LogReport.org

This file is part of Lire.

Lire is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

bestie pls read this part fr fr — the whole "WITHOUT ANY WARRANTY" thing is not a joke, it's literally all caps in the original and it means what it says. 💀

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html.

okay that's the whole page!! this was Lire 2.1.1, dated 2025-09-28, page Syslog(3pm) — mwah, go parse something gorgeous 💋💖✨

📦 where this page comes from