From 6c4eb383642a73159515a07e9920dbede35daf5f Mon Sep 17 00:00:00 2001 From: "James Truher [MSFT]" Date: Mon, 5 Jun 2023 11:07:05 -0700 Subject: [PATCH] Update syslog parser to handle modern formats. (#19737) Co-authored-by: James Truher --- test/tools/Modules/PSSysLog/PSSysLog.psm1 | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/test/tools/Modules/PSSysLog/PSSysLog.psm1 b/test/tools/Modules/PSSysLog/PSSysLog.psm1 index 4dd0da0ade..634e090310 100644 --- a/test/tools/Modules/PSSysLog/PSSysLog.psm1 +++ b/test/tools/Modules/PSSysLog/PSSysLog.psm1 @@ -218,8 +218,22 @@ class PSLogItem In those cases, a single message is logged in the following format MMM dd HH:MM:SS machinename id[PID]: message repeated NNN times: [(commitid:TID:CHANNEL) [EventName] Message] + + Alternatively, more recent syslog daemons may change the message format to: + + 2023-06-02T22:49:50.513735+00:00 machinename id[PID]: message repeated NNN times: [(commitid:TID:CHANNEL) [EventName] Message] + + the first element of the line may be converted to a datetime, which we can use to convert the input to the expected string. #> + $firstToken = $content.split()[0] + $dt = $firstToken -as [DateTime] + if ($dt) + { + $replacement = "{0:MMM} {0:dd} {0:hh}:{0:mm}:{0:ss}" -f $dt + $content = $content.replace($firstToken,$replacement) + } + # split contents into separate space delimited tokens (first 7) and leave the rest as the message. [string[]] $parts = $content.Split(' ', 8, [System.StringSplitOptions]::RemoveEmptyEntries)