From 920cc1e1640a7a01145111530106cf96a60b6086 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Fri, 12 Sep 2008 14:20:47 +0200 Subject: bugfix: colon after date should be ignored, but was not. This has now been corrected. Required change to the internal ParseTIMESTAMP3164() interface. --- syslogd.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'syslogd.c') diff --git a/syslogd.c b/syslogd.c index a5483d80..6855a8a5 100644 --- a/syslogd.c +++ b/syslogd.c @@ -1392,13 +1392,18 @@ static int parseLegacySyslogMsg(msg_t *pMsg, int flags) */ if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { /* we are done - parse pointer is moved by ParseTIMESTAMP3339 */; - } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse) == TRUE) { - p2parse += 16; + } else if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { + /* we are done - parse pointer is moved by ParseTIMESTAMP3164 */; } else if(*p2parse == ' ') { /* try to see if it is slighly malformed - HP procurve seems to do that sometimes */ - if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), p2parse+1) == TRUE) { + ++p2parse; /* move over space */ + if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &p2parse) == TRUE) { /* indeed, we got it! */ - p2parse += 17; + /* we are done - parse pointer is moved by ParseTIMESTAMP3164 */; } else { + /* parse pointer needs to be restored, as we moved it off-by-one + * for this try. + */ + --p2parse; flags |= ADDDATE; } } else { -- cgit v1.2.3