public void TestSyslogCustomParserParsing() { var testprival = "<140>"; var severity = (Severity)Enum.ToObject(typeof(Severity), 140 & 0x7); var facility = (Facility)Enum.ToObject(typeof(Facility), 140 >> 3); var testmessage = "A message with any pri-val"; var testString = testprival + testmessage; var udData = new ArraySegment <byte>(Encoding.ASCII.GetBytes(testString)); var pHeader = new IpPacketHeader( IPAddress.Parse("127.0.0.1"), IPAddress.Parse("127.0.0.1"), false, 4, 0, 0, (ushort)(udData.Array.Length + 20 + 8), 0, 0, 0, 255, 0 ); var udHeader = new UdpDatagramHeader(16, 16, (ushort)udData.Array.Length, 0); UdpDatagram ud = new UdpDatagram() { UdpDatagramHeader = udHeader, UdpData = udData, PacketHeader = pHeader, ReceivedTime = DateTimeOffset.UtcNow }; var customParser = new Regex(@"(?<WithAny>with\sany)", RegexOptions.ExplicitCapture); var sysparser = new SyslogParser(customParser); var sys = sysparser.Parse(ud); Assert.IsNotNull(sys); Assert.AreEqual(testmessage, sys.Message); Assert.AreEqual(severity, sys.LogSeverity); Assert.AreEqual(facility, sys.LogFacility); Assert.AreEqual("with any", sys.NamedCollectedMatches["WithAny"]); }
//List<Stream> oldStream; //bool firstrun = true; #endregion fields & pins public void Evaluate(int spreadMax) { FMessage.SliceCount = spreadMax; FFacility.SliceCount = spreadMax; FSeverity.SliceCount = spreadMax; FTimestamp.SliceCount = spreadMax; FHostname.SliceCount = spreadMax; FAppName.SliceCount = spreadMax; FProcId.SliceCount = spreadMax; FMsgId.SliceCount = spreadMax; FStructuredDataName.SliceCount = spreadMax; FStructuredDataValue.SliceCount = spreadMax; #region test //if (firstrun) // oldStream = new List<Stream>(); //if (firstrun || oldStream.Count != FStreamIn.SliceCount) //{ // oldStream.Clear(); // foreach (Stream s in FStreamIn) // oldStream.Add(s); //} #endregion test for (int i = 0; i < spreadMax; i++) { #region test //if (firstrun || oldStream[i] != FStreamIn[i] ) //IsChanged doesn't work with Streams //{ // if (firstrun == true) // firstrun = false; // oldStream[i] = FStreamIn[i]; #endregion test if (FStreamIn[i].Length > 0) { // Stream > string byte[] buffer = new byte[FStreamIn[i].Length]; int test = FStreamIn[i].Read(buffer, 0, (int)FStreamIn[i].Length); string stringMessage = System.Text.Encoding.ASCII.GetString(buffer, 0, buffer.Length); SyslogParser prs = new SyslogParser(); SyslogMessage msg = prs.Parse(stringMessage); if (msg != null) { FMessage[i] = msg.MessageText; FFacility[i] = msg.Facility; FSeverity[i] = msg.Severity; FTimestamp[i] = msg.TimeStamp.ToString(); FHostname[i] = msg.HostName; FAppName[i] = msg.AppName; FProcId[i] = msg.ProcessID; FMsgId[i] = msg.MessageID; int sdCount = msg.StructuredData.Count; // is normally 1 (when created with Syslog (Raw join), because it can't pack several sd elements into one sd package) FStructuredDataName[i].SliceCount = 0; FStructuredDataValue[i].SliceCount = 0; for (int s = 0; s < sdCount; s++) { // each sd contains n sd elements int keycount = msg.StructuredData[s].Properties.Count; for (int k = 0; k < keycount; k++) { FStructuredDataName[i].Add <string>(msg.StructuredData[s].Properties.AllKeys[k]); FStructuredDataValue[i].Add <string>(msg.StructuredData[s].Properties.GetValues(k)[0]); } } } else { FMessage[i] = "corrupt message"; FFacility[i] = SyslogFacility.Unknown; FSeverity[i] = SyslogSeverity.Unknown; FTimestamp[i] = ""; FHostname[i] = ""; FAppName[i] = ""; FProcId[i] = ""; FMsgId[i] = ""; FStructuredDataName[i].SliceCount = 0; FStructuredDataValue[i].SliceCount = 0; } } } }