Module Syslog_messageSource

Syslog message parser and unparser

Syslog-message is a module for handling syslog messages, as defined in RFC 3164.

The parse function transforms a string to a syslog message t, using a context of default parameters. Such a message can be transformed into a string to_string or pretty printed pp_string, pp.

1.0.0 - homepage

Sourcetype facility =
  1. | Kernel_Message
  2. | User_Level_Messages
  3. | Mail_System
  4. | System_Daemons
  5. | Security_Authorization_Messages
  6. | Messages_Generated_Internally_By_Syslogd
  7. | Line_Printer_Subsystem
  8. | Network_News_Subsystem
  9. | UUCP_subsystem
  10. | Clock_Daemon
  11. | Security_Authorization_Messages_10
  12. | Ftp_Daemon
  13. | Ntp_Subsystem
  14. | Log_Audit
  15. | Log_Alert
  16. | Clock_Daemon_15
  17. | Local0
  18. | Local1
  19. | Local2
  20. | Local3
  21. | Local4
  22. | Local5
  23. | Local6
  24. | Local7

The type for Facilities

Sourceval string_of_facility : facility -> string

string_of_facility f is data, the string representation of f.

Sourcetype severity =
  1. | Emergency
  2. | Alert
  3. | Critical
  4. | Error
  5. | Warning
  6. | Notice
  7. | Informational
  8. | Debug

The type for Severity levels

Sourceval string_of_severity : severity -> string

string_of_severity s is data, the string representation of s.

Sourcetype ctx = {
  1. timestamp : Ptime.t;
  2. hostname : string;
  3. set_hostname : bool;
}

ctx provides additional information to the parse function in case one of the sub-parsers fails.

  • timestamp: A timestamp
  • hostname: Hostname, IPv4 or IPv6 address of the sender. "-" if unknown.
  • set_hostname: If true, the parse function will skip its hostname sub-parser and use the hostname from ctx instead.

set_hostname is automatically set by the timestamp sub-parser when it fails, because at this point it is no longer possible to determine the hostname from the input string.

Sourcetype t = {
  1. facility : facility;
  2. severity : severity;
  3. timestamp : Ptime.t;
  4. hostname : string;
  5. tag : string;
  6. content : string;
}

The type for Syslog messages

Sourceval pp : Format.formatter -> t -> unit

pp ppf t prints the syslog message t on ppf.

Sourceval to_string : t -> string

to_string t is str, a pretty printed string of syslog message t.

Sourceval decode : ctx:ctx -> string -> (t, [> Rresult.R.msg ]) result

decode ~ctx data is t, either Ok t, a successfully decoded syslog message, or Error e.

Sourceval encode : ?len:int -> t -> string

encode ~len t is data, the encoded syslog message t, truncated to len bytes. If len is 0 the output is not truncated.

Warning: Since version 1.0.0, messages are no longer truncated to 1024 bytes by default.

Sourceval encode_local : ?len:int -> t -> string

encode_local ~len t behaves as encode except that the message is formatted for sending to the local syslog daemon (e.g. on /dev/log).

Sourcemodule Rfc3164_Timestamp : sig ... end

RFC 3164 Timestamps