/// <remarks/>
public SyslogMessageEventArgs(SyslogMessage msg)
{
Message = msg;
}
/// <summary>
/// Parses Syslog messages according to RFC5424
/// </summary>
/// <param name="payload"></param>
/// <returns></returns>
private static SyslogMessage Parse5424(string payload)
{
SyslogMessage ret = new SyslogMessage();
try
{
int pointer = 1;
String newPayload = payload.Substring(pointer);
//Calculate prival = Facility*8 + Severity...
String prival = newPayload.Split('>')[0];
Int32 severity;
ret.Facility = (SyslogFacility)Math.DivRem(Int32.Parse(prival), 8, out severity);
ret.Severity = (SyslogSeverity)severity;
pointer += prival.Length + 1;
//Calculate Version...
newPayload = payload.Substring(pointer);
string version = newPayload.Substring(0, 1);
if (version != "1")
{
NotSupportedException ex = new NotSupportedException("Only Syslog version 1 is supported");
ex.Data["version"] = version;
throw ex;
}
pointer += 2;
//Calculate Timestamp...
newPayload = payload.Substring(pointer);
String timestamp = newPayload.Split(' ')[0];
if (timestamp != "-")
{
String[] elem = timestamp.Split('T');
Int32 year = Int32.Parse(elem[0].Split('-')[0]);
Int32 month = Int32.Parse(elem[0].Split('-')[1]);
Int32 day = Int32.Parse(elem[0].Split('-')[2]);
String[] elem2;
Int32 fusoH = 0;
Int32 fusoM = 0;
if (elem[1].Contains("-"))
{
elem2 = elem[1].Split('-');
fusoH = Int32.Parse(elem2[1].Split(':')[0]) * -1;
fusoM = Int32.Parse(elem2[1].Split(':')[1]) * -1;
}
else if (elem[1].Contains("+"))
{
elem2 = elem[1].Split('+');
fusoH = Int32.Parse(elem2[1].Split(':')[0]);
fusoM = Int32.Parse(elem2[1].Split(':')[1]);
}
else
{
elem2 = elem[1].Split('Z');
}
Int32 hour = Int32.Parse(elem2[0].Split(':')[0]);
Int32 minute = Int32.Parse(elem2[0].Split(':')[1]);
Int32 sec = Int32.Parse(elem2[0].Split(':')[2].Split('.')[0]);
string msecStr = elem2[0].Split(':')[2];
Int32 msec = 0;
if (msecStr.IndexOf('.') > -1)
{
msec = Int32.Parse(msecStr.Split('.')[1].Substring(0, 3));
}
//UTC or reference time
ret.Timestamp = new DateTime(year, month, day, hour, minute, sec, msec);
//Time zone offset
if (fusoH == 0 && fusoM == 0)
{
ret.TimeOffset = null;
}
else
{
ret.TimeOffset = new TimeSpan(fusoH, fusoM, 0);
}
}
else
{
ret.Timestamp = null;
ret.TimeOffset = null;
}
pointer += timestamp.Length + 1;
//Calculate HostIP...
newPayload = payload.Substring(pointer);
ret.Host = (newPayload.Split(' ')[0] == "-") ? null : newPayload.Split(' ')[0];
pointer += (ret.Host == null) ? 2 : ret.Host.Length + 1;
//Calculate AppName...
newPayload = payload.Substring(pointer);
ret.ApplicationName = (newPayload.Split(' ')[0] == "-") ? null : newPayload.Split(' ')[0];
pointer += (ret.ApplicationName == null) ? 2 : ret.ApplicationName.Length + 1;
//Calculate ProcID...
newPayload = payload.Substring(pointer);
ret.ProcessID = (newPayload.Split(' ')[0] == "-") ? null : newPayload.Split(' ')[0];
pointer += (ret.ProcessID == null) ? 2 : ret.ProcessID.Length + 1;
//Calculate MessageID...
newPayload = payload.Substring(pointer);
ret.MessageId = (newPayload.Split(' ')[0] == "-") ? null : newPayload.Split(' ')[0];
pointer += (ret.MessageId == null) ? 2 : ret.MessageId.Length + 1;
//Calculate StructuredData...
newPayload = payload.Substring(pointer);
String structuredData = "[";
if (newPayload.StartsWith("-"))
{
ret.Data = null;
}
else
{
for (int j = 1; j < newPayload.Length - 1; j++)
{
structuredData += newPayload[j];
if (newPayload[j - 1] == '"' && newPayload[j] == ']' && newPayload[j + 1] == ' ')
{
break;
}
}
if (!structuredData.EndsWith("]"))
{
structuredData += ']';
}
ret.Data = new Dictionary <string, IDictionary <string, string> >();
structuredData = structuredData.Replace("\\[", "@*°");
structuredData = structuredData.Replace("\\]", "çà§");
String[] elementi = structuredData.Split('[', ']');
for (int i = 0; i < elementi.Length; i++)
{
if (elementi[i].Length == 0)
{
continue;
}
String[] subElem = elementi[i].Split(' ');
String key = subElem[0];
Dictionary <string, string> values = new Dictionary <string, string>();
for (int k = 1; k < subElem.Length; k++)
{
String[] subSubElem = subElem[k].Split('=');
subSubElem[0] = subSubElem[0].Replace("@*°", "\\[");
subSubElem[0] = subSubElem[0].Replace("çà§", "\\]");
subSubElem[1] = subSubElem[1].Replace("@*°", "\\[");
subSubElem[1] = subSubElem[1].Replace("çà§", "\\]");
values.Add(subSubElem[0], subSubElem[1].Substring(1, subSubElem[1].Length - 2));
}
ret.Data.Add(key, values);
}
}
pointer += structuredData.Length + 1;
//Calculate Msg if present...
if (pointer >= payload.Length)
{
ret.Text = null;
}
else
{
newPayload = payload.Substring(pointer);
if (newPayload.EndsWith("\r\n"))
{
newPayload = newPayload.Substring(0, newPayload.Length - 2);
}
else if (newPayload.EndsWith("\n"))
{
newPayload = newPayload.Substring(0, newPayload.Length - 1);
}
byte[] bom = { 0xef, 0xbb, 0xbf }, utf8String = Encoding.UTF8.GetBytes(newPayload);
if (bom[0] == utf8String[0] && bom[1] == utf8String[1] && bom[2] == utf8String[2])
{
ret.Text = Encoding.UTF8.GetString(utf8String, 3, utf8String.Length - 3); //Cut BOM
}
else
{
ret.Text = newPayload;
}
}
//Return the SyslogMessage...
return(ret);
}
catch (FormatException ex)
{
ex.Data.Add("Payload", payload);
throw;
}
catch (Exception e)
{
FormatException ex = new FormatException("Message not in Syslog format", e);
ex.Data.Add("Payload", payload);
throw ex;
}
}
/// <summary>
/// Gets FFDA information, if message is FFD
/// </summary>
/// <param name="msg">Syslog message to parse</param>
/// <returns>FFDA information about the message</returns>
/// <exception cref="System.InvalidOperationException">Message is not FFD</exception>
public static FieldFailureDataInformation GetFailureData(this SyslogMessage msg)
{
return(new FieldFailureDataInformation(msg));
}
/// <summary>
/// Parses Syslog messages according to RFC3164
/// </summary>
/// <param name="payload"></param>
/// <returns></returns>
private static SyslogMessage Parse3164(string payload)
{
SyslogMessage ret = new SyslogMessage();
try
{
int pointer = 1;
String newPayload = payload.Substring(pointer);
//Calculate prival = Facility*8 + Severity...
String prival = newPayload.Split('>')[0];
Int32 severity;
ret.Facility = (SyslogFacility)Math.DivRem(Int32.Parse(prival), 8, out severity);
ret.Severity = (SyslogSeverity)severity;
pointer += prival.Length + 1;
//Calculate Timestamp...
newPayload = payload.Substring(pointer);
Int32 month = GetMonthByName(newPayload.Substring(0, 3));
pointer += 4;
newPayload = payload.Substring(pointer);
int day = Int32.Parse(newPayload[0] == ' ' ? newPayload.Substring(1, 1) : newPayload.Substring(0, 2));
pointer += 3;
newPayload = payload.Substring(pointer);
String timestamp = newPayload.Split(' ')[0];
Int32 hour = Int32.Parse(timestamp.Split(':')[0]);
Int32 minute = Int32.Parse(timestamp.Split(':')[1]);
Int32 sec = Int32.Parse(timestamp.Split(':')[2]);
ret.Timestamp = new DateTime(DateTime.Today.Year, month, day, hour, minute, sec, 0);
pointer += timestamp.Length + 1;
//Calculate HostIP...
newPayload = payload.Substring(pointer);
ret.Host = newPayload.Split(' ')[0];
pointer += ret.Host.Length + 1;
//Calculate AppName...
newPayload = payload.Substring(pointer);
String temp = newPayload.Split(' ')[0];
if (temp.Contains("["))
{
ret.ApplicationName = temp.Split('[')[0];
ret.ProcessID = temp.Split('[')[1].Split(']')[0];
}
else
{
ret.ApplicationName = temp;
ret.ProcessID = null;
}
pointer += temp.Length + 1;
//Calculate MessageID...
ret.MessageId = null;
//Calculate StructuredData...
ret.Data = null;
//Calculate Msg if present...
if (pointer >= payload.Length)
{
ret.Text = null;
}
else
{
newPayload = payload.Substring(pointer);
if (newPayload.EndsWith("\r\n"))
{
newPayload = newPayload.Substring(0, newPayload.Length - 2);
}
else if (newPayload.EndsWith("\n"))
{
newPayload = newPayload.Substring(0, newPayload.Length - 1);
}
ret.Text = newPayload;
}
//Return the SyslogMessage...
return(ret);
}
catch (FormatException ex)
{
ex.Data.Add("Payload", payload);
throw;
}
catch (Exception e)
{
FormatException ex = new FormatException("Message not in Syslog format", e);
ex.Data.Add("Payload", payload);
throw ex;
}
}
