diff --git a/server/datedetector.py b/server/datedetector.py index 09567656..b4d0a471 100644 --- a/server/datedetector.py +++ b/server/datedetector.py @@ -99,6 +99,12 @@ class DateDetector: template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}") template.setPattern("%Y-%m-%d %H:%M:%S") self.__templates.append(template) + # custom for syslog-ng 2006.12.21 06:43:20 + template = DateStrptime() + template.setName("Year.Month.Day Hour:Minute:Second") + template.setRegex("\d{4}.\d{2}.\d{2} \d{2}:\d{2}:\d{2}") + template.setPattern("%Y.%m.%d %H:%M:%S") + self.__templates.append(template) # named 26-Jul-2007 15:20:52.252 template = DateStrptime() template.setName("Day-MONTH-Year Hour:Minute:Second[.Millisecond]") diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py index 70447b25..074bdb88 100644 --- a/testcases/datedetectortestcase.py +++ b/testcases/datedetectortestcase.py @@ -57,6 +57,26 @@ class DateDetectorTest(unittest.TestCase): self.assertEqual(self.__datedetector.getTime(log), date) self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix) + def testVariousTimes(self): + """Test detection of various common date/time formats f2b should understand + """ + date = [2005, 1, 23, 21, 59, 59, 1, 23, -1] + dateUnix = 1106513999.0 + + for sdate in ( + "Jan 23 21:59:59", + "2005.01.23 21:59:59", + "23/01/2005 21:59:59", + ): + log = sdate + "[sshd] error: PAM: Authentication failure" + # exclude + + # TODO (Yarik is confused): figure out why for above it is + # "1" as day of the week which would be Tue, although it + # was Sun + self.assertEqual(self.__datedetector.getTime(log)[:6], date[:6]) + self.assertEqual(self.__datedetector.getUnixTime(log), dateUnix) + # def testDefaultTempate(self): # self.__datedetector.setDefaultRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") # self.__datedetector.setDefaultPattern("%b %d %H:%M:%S")