improve syslog syntax

This commit is contained in:
Keith Hall 2021-04-05 22:17:47 +03:00
parent 1537733e6b
commit 782ede5db5
3 changed files with 63 additions and 10 deletions

View File

@ -5,10 +5,15 @@ name: syslog
file_extensions:
- syslog
scope: text.syslog
variables:
ipv4_part: (?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
contexts:
main:
- match: '^\w+\s+\d+\s+\d{2}:\d{2}:\d{2}'
- match: ^(\w+\s+\d+)\s+(\d{2}:\d{2}:\d{2})
scope: meta.datetime.syslog constant.numeric.syslog
captures:
1: meta.date.syslog
2: meta.time.syslog
push: loghost
loghost:
- match: '[\w-]+'
@ -20,7 +25,8 @@ contexts:
1: support.function.process.syslog
2: punctuation.separator.pid.begin.syslog
3: meta.pid.syslog meta.number.integer.syslog constant.numeric.value.syslog
4: punctuation.separator.mapping.syslog
4: punctuation.separator.pid.end.syslog
5: punctuation.separator.mapping.syslog
set: structured-data
structured-data:
- match: '\['
@ -56,15 +62,50 @@ contexts:
captures:
1: punctuation.definition.string.begin.syslog
3: punctuation.definition.string.end.syslog
- match: \d+
scope: meta.number.integer.syslog constant.numeric.value.syslog
- include: numbers
- match: \b(CMD)\b\s+(\()
captures:
1: entity.name.label.syslog
2: punctuation.section.block.begin.syslog
embed: scope:source.shell.bash
escape: \)
escape: \)$
escape_captures:
0: punctuation.section.block.end.syslog
- match: '<\w+>'
scope: constant.language.syslog
- match: (?i:fail(?:ure|ed)?|error)
scope: invalid.illegal.error.syslog
- match: $
pop: true
numbers:
- match: (?=(?:{{ipv4_part}}\.){3}{{ipv4_part}})
push:
- meta_scope: meta.ipaddress.v4.syslog meta.number.integer.decimal.syslog
- match: \d+
scope: constant.numeric.value.syslog
- match: \.
scope: punctuation.separator.sequence.syslog
- match: ''
pop: true
- match: (?=(?:\h{0,4}:){2,6}\h{1,4})
push:
- meta_scope: meta.ipaddress.v6.syslog meta.number.integer.hexadecimal.syslog
- match: \h{1,4}
scope: constant.numeric.value.syslog
- match: ':'
scope: punctuation.separator.sequence.syslog
- match: ''
pop: true
- match: (0x)(\h+)(?:(\.)(\h+))?
scope: meta.number.float.hexadecimal.syslog
captures:
1: constant.numeric.base.syslog
2: constant.numeric.value.syslog
3: constant.numeric.value.syslog punctuation.separator.decimal.syslog
4: constant.numeric.value.syslog
- match: \b\d+(\.)\d+\b
scope: meta.number.float.syslog constant.numeric.value.syslog
captures:
1: punctuation.separator.decimal.syslog
- match: \b\d+\b
scope: meta.number.integer.syslog constant.numeric.value.syslog

View File

@ -1,5 +1,11 @@
Apr 4 00:00:01 hostname-here systemd[1]: logrotate.service: Succeeded.
Apr 4 00:00:01 hostname-here systemd[1]: Finished Rotate log files.
Apr 4 00:00:21 hostname-here kernel: [55604.908232] audit: type=1400 audit(1617483621.094:28): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=59311 comm="cups-browsed" capability=23 capname="sys_nice"
Apr 4 09:30:01 hostname-here CRON[89278]: (root) CMD ([ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi)
Apr 4 22:00:45 hostname-here dbus-daemon[1094]: [session uid=1000 pid=1094] Successfully activated service 'io.github.celluloid_player.Celluloid'
Apr 4 00:00:01 hostname-here systemd[1]: logrotate.service: Succeeded.
Apr 4 00:00:01 hostname-here systemd[1]: Finished Rotate log files.
Apr 4 00:00:01 hostname-here colord[920]: failed to get session [pid 137485]: No data available
Apr 4 00:00:21 hostname-here kernel: [55604.908232] audit: type=1400 audit(1617483621.094:28): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=59311 comm="cups-browsed" capability=23 capname="sys_nice"
Apr 4 00:01:38 hostname-here systemd-resolved[721]: Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, retrying transaction with reduced feature level UDP.
Apr 4 00:04:46 hostname-here ntpd[952]: Soliciting pool server 255.76.59.37
Apr 4 00:05:21 hostname-here ntpd[952]: ::1 local addr 0:0:0:0:0:0:0:1 -> <null>
Apr 4 00:06:29 hostname-here ntpd[952]: receive: Unexpected origin timestamp 0xe414a8d1.82e825f5 does not match aorg 0xe414a8d5.82c50d8c from server@127.0.0.1 xmt 0xe414a8d1.e671d7c4
Apr 4 09:30:01 hostname-here CRON[89278]: (root) CMD ([ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi)
Apr 4 16:32:07 hostname-here NetworkManager[740]: <info> [1617629527.1101] manager: NetworkManager state is now CONNECTED_GLOBAL
Apr 4 22:00:45 hostname-here dbus-daemon[1094]: [session uid=1000 pid=1094] Successfully activated service 'io.github.celluloid_player.Celluloid'

View File

@ -1,5 +1,11 @@
Apr 4 00:00:01 hostname-here systemd[1]: logrotate.service: Succeeded.
Apr 4 00:00:01 hostname-here systemd[1]: Finished Rotate log files.
Apr 4 00:00:01 hostname-here colord[920]: failed to get session [pid 137485]: No data available
Apr 4 00:00:21 hostname-here kernel: [55604.908232] audit: type=1400 audit(1617483621.094:28): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=59311 comm="cups-browsed" capability=23 capname="sys_nice"
Apr 4 00:01:38 hostname-here systemd-resolved[721]: Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, retrying transaction with reduced feature level UDP.
Apr 4 00:04:46 hostname-here ntpd[952]: Soliciting pool server 255.76.59.37
Apr 4 00:05:21 hostname-here ntpd[952]: ::1 local addr 0:0:0:0:0:0:0:1 -> <null>
Apr 4 00:06:29 hostname-here ntpd[952]: receive: Unexpected origin timestamp 0xe414a8d1.82e825f5 does not match aorg 0xe414a8d5.82c50d8c from server@127.0.0.1 xmt 0xe414a8d1.e671d7c4
Apr 4 09:30:01 hostname-here CRON[89278]: (root) CMD ([ -x /etc/init.d/anacron ] && if [ ! -d /run/systemd/system ]; then /usr/sbin/invoke-rc.d anacron start >/dev/null; fi)
Apr 4 16:32:07 hostname-here NetworkManager[740]: <info> [1617629527.1101] manager: NetworkManager state is now CONNECTED_GLOBAL
Apr 4 22:00:45 hostname-here dbus-daemon[1094]: [session uid=1000 pid=1094] Successfully activated service 'io.github.celluloid_player.Celluloid'