Home | About | Sematext search-lucene.com search-hadoop.com
 Search Hadoop and all its subprojects:

Switch to Plain View
Flume >> mail # dev >> Review Request: FLUME-1277: Error parsing Syslog rfc 3164 messages with null values


+
Brock Noland 2012-10-30, 19:08
+
Brock Noland 2012-10-30, 19:10
+
Alexander Alten-Lorenz 2012-11-06, 08:42
+
Brock Noland 2012-11-06, 15:20
+
Alexander Alten-Lorenz 2012-11-10, 10:38
+
Alexander Alten-Lorenz 2012-11-06, 15:38
+
Mike Percy 2012-11-10, 02:05
+
Mike Percy 2012-11-10, 02:12
Copy link to this message
-
Re: Review Request: FLUME-1277: Error parsing Syslog rfc 3164 messages with null values

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/7780/
-----------------------------------------------------------

(Updated Nov. 10, 2012, 4:24 p.m.)
Review request for Flume.
Changes
-------

Updated patch based on review
Description
-------

The SyslogUtils class doesn't properly parse rfc 3164 style messages containing a null (hyphen) value. e.g.,
<10>Apr 1 13:14:04 ubuntu-11.cloudera.com - rest_of_message

It tries to parse it as a 5424 style message, skips over the date information, and interprets the first hyphen as a null timestamp. Part of the problem is the use of a Scanner and regex. This skips over a properly formatted 3164 style message until it finds anything that matches the 5424 regex, including a hyphen.
This addresses bug FLUME-1277.
    https://issues.apache.org/jira/browse/FLUME-1277
Diffs (updated)
-----

  flume-ng-core/src/main/java/org/apache/flume/source/SyslogUtils.java 4cded11
  flume-ng-core/src/test/java/org/apache/flume/source/TestSyslogUtils.java acfb29d

Diff: https://reviews.apache.org/r/7780/diff/
Testing
-------

Unit test added and units pass
Thanks,

Brock Noland

+
Mike Percy 2012-11-10, 20:28