public static Rfc3164SyslogMessage Parse(string syslogMessage)
{
Rfc3164SyslogMessage msg = null;
System.Text.RegularExpressions.Regex _re =
new System.Text.RegularExpressions.Regex(RegexExpression, System.Text.RegularExpressions.RegexOptions.IgnorePatternWhitespace
| System.Text.RegularExpressions.RegexOptions.Singleline
| System.Text.RegularExpressions.RegexOptions.Compiled);
System.Text.RegularExpressions.Match m = _re.Match(syslogMessage);
if (!m.Success)
{
return(msg);
}
msg = new Rfc3164SyslogMessage();
if (m.Groups["PRI"].Success)
{
string pri = m.Groups["PRI"].Value;
int priority = int.Parse(pri.Substring(1, pri.Length - 2));
msg.Facility = (FacilityType)System.Math.Floor((double)priority / 8);
msg.Severity = (SeverityType)(priority % 8);
}
else
{
msg.Facility = FacilityType.User;
msg.Severity = SeverityType.Notice;
}
if (m.Groups["HDR"].Success)
{
string hdr = m.Groups["HDR"].Value.TrimEnd();
int idx = hdr.LastIndexOf(' ');
msg.Datestamp = System.DateTime.ParseExact(hdr.Substring(0, idx), "MMM dd HH:mm:ss", null);
msg.Hostname = hdr.Substring(idx + 1);
}
else
{
msg.Datestamp = System.DateTime.Now;
try
{
// IPHostEntry he = Dns.GetHostEntry(receiveResult.RemoteEndPoint.Address);
// msg.Hostname = he.HostName;
}
catch (System.Net.Sockets.SocketException)
{
// msg.Hostname = receiveResult.RemoteEndPoint.Address.ToString();
}
} // End else of if (m.Groups["HDR"].Success)
msg.Content = m.Groups["MSG"].Value;
// msg.RemoteIP = receiveResult.RemoteEndPoint.Address.ToString();
msg.LocalDate = System.DateTime.Now;
// if (MessageReceived != null) MessageReceived(msg);
msg.IsValid = true;
msg.RawMessage = syslogMessage;
msg.MessageReceivedTime = System.DateTime.UtcNow;
return(msg);
} // End Function ParseMessage
public override void OnReceived(System.Net.EndPoint endpoint, byte[] buffer, long offset, long size)
{
bool octetCounting = false;
bool isRfc5424 = false;
bool isRfc3164 = false;
string rawMessage = null;
try
{
rawMessage = System.Text.Encoding.UTF8.GetString(buffer, (int)offset, (int)size);
System.Console.WriteLine("Incoming: " + rawMessage);
if (string.IsNullOrWhiteSpace(rawMessage))
{
return;
}
string message = rawMessage.TrimStart();
if (IsNumber(message))
{
return; // Discard - this is just the length of a message
}
// rfc_5424_octet_counting: "218 <134>1 2021-09-16T21:44:22.395060+02:00 DESKTOP-6CN7QMR TestSerilog 31308 - [meta MessageNumber="2" AProperty="0.8263707183424247"] TCP: This is test message 00002
// rfc_5424_nontransparent_framing: "<134>1 2021-09-16T21:44:22.395060+02:00 DESKTOP-6CN7QMR TestSerilog 31308 - [meta MessageNumber="2" AProperty="0.8263707183424247"] TCP: This is test message 00002
// rfc_3164_octet_counting: "218 <30>Oct
// rfc_3164_nontransparent_framing: "<30>Oct
// p = ((int)facility * 8) + (int)severity;
// ==> severity = p % 8
// ==> faciliy = p \ 8
// Probe octet-framing and message-type
// Let's do this WITHOUT regex - for speed !
int ind = message.IndexOf('<');
if (ind != 0)
{
if (ind != -1)
{
octetCounting = true;
string octet = message.Substring(0, ind - 1);
octet = octet.TrimEnd(trimChars);
if (!IsNumber(octet))
{
throw new System.IO.InvalidDataException("Invalid octet framing ! \r\nMessage: " + rawMessage);
}
message = message.Substring(ind);
}
else
{
throw new System.IO.InvalidDataException(rawMessage);
}
}
int closeAngleBracketIndex = message.IndexOf('>');
if (closeAngleBracketIndex != -1)
{
closeAngleBracketIndex++;
string messageContent = message.Substring(closeAngleBracketIndex);
messageContent = messageContent.TrimStart(trimChars);
System.Console.WriteLine(messageContent);
if (messageContent.Length > 0)
{
if (char.IsDigit(messageContent[0]))
{
isRfc5424 = true;
}
else
{
isRfc3164 = true;
}
}
else
{
throw new System.IO.InvalidDataException(rawMessage);
}
}
else
{
throw new System.IO.InvalidDataException(rawMessage);
}
System.Console.WriteLine("Octet counting: {0}", octetCounting);
if (isRfc5424)
{
System.Console.WriteLine("rfc_5424");
Rfc5424SyslogMessage msg5424 = Rfc5424SyslogMessage.Parse(message);
msg5424.SetSourceEndpoint(endpoint);
System.Console.WriteLine(msg5424);
}
else if (isRfc3164)
{
System.Console.WriteLine("rfc_3164");
Rfc3164SyslogMessage msg3164 = Rfc3164SyslogMessage.Parse(message);
msg3164.RemoteIP = endpoint.ToString();
System.Console.WriteLine(msg3164);
}
}
catch (System.Exception ex)
{
System.Console.WriteLine(ex.Message);
System.Console.WriteLine(ex.StackTrace);
// bool octetCounting = false;
if (isRfc5424)
{
Rfc5424SyslogMessage msg5424 = Rfc5424SyslogMessage.Invalid(rawMessage, ex);
}
else if (isRfc3164)
{
Rfc3164SyslogMessage msg3164 = Rfc3164SyslogMessage.Invalid(rawMessage, ex);
}
else
{
}
}
}
