turns out it was a locale issue, I set the locale on all the DateFormat objects to Locale.ROOT and then things parse correctly.

Hi Benjamin,

I've until now pasted extract of the syslogd.log file. But, there's also another log in output.log.

Whenever, openNMS processes a new syslog message, I get the following lines in output.log:

Exception in thread "SyslogConnection" java.lang.NullPointerException
at java.util.Calendar.setTime(Calendar.java:1075)
at java.text.SimpleDateFormat.format(SimpleDateFormat.java:876)
at java.text.SimpleDateFormat.format(SimpleDateFormat.java:869)
at java.text.DateFormat.format(DateFormat.java:316)
at org.opennms.netmgt.EventConstants.formatToString(EventConstants.java:1185)
at org.opennms.netmgt.model.events.EventBuilder.setCreationTime(EventBuilder.java:139)
at org.opennms.netmgt.syslogd.ConvertToEvent.make(ConvertToEvent.java:215)
at org.opennms.netmgt.syslogd.ConvertToEvent.make(ConvertToEvent.java:139)
at org.opennms.netmgt.syslogd.SyslogConnection.run(SyslogConnection.java:107)
at java.lang.Thread.run(Thread.java:662)

I think some error handling might be missing in ConvertToEvent to handle the case when the parser couldn't get the syslog message's date.

BR,

Cyrille

Nope. That's a paste issue on jira; My regex do contains the asterisks.

Could you provide me a syslogd.log trace of a matching syslog message? I believe it would help me to solve this issue.

BR,

Cyrille

Dunno about the other parsing issues, but this definitely won't match:

<match type="regex" expression="^sudo:\s+(.?) : user NOT in sudoers ; TTY=(.?) ; PWD=(.?) ; USER=(.?) ; COMMAND=(.*?)$" />
<match type="regex" expression="^(.?) : user NOT in sudoers ; TTY=(.?) ; PWD=(.?) ; USER=(.?) ; COMMAND=(.*?)$" />

you're doing ".?" in your regexes which means it will match 0 or 1 of any character. You need ".*?" (note the asterisk)

Unfortunately, it sitll doesn't work with the nightly snapshot:

root@opennms:/etc/opennms# apt-cache policy opennms
opennms:
Installé : 1.10.1-0.20120315.34
Candidat : 1.10.1-0.20120315.34
Table de version :

•  

  •  

    • 1.10.1-0.20120315.34 0
      500 http://debian.opennms.org/ testing/main amd64 Packages
      100 /var/lib/dpkg/status

I've tried with both following regex without success:

<match type="regex" expression="^sudo:\s+(.?) : user NOT in sudoers ; TTY=(.?) ; PWD=(.?) ; USER=(.?) ; COMMAND=(.*?)$" />
<match type="regex" expression="^(.?) : user NOT in sudoers ; TTY=(.?) ; PWD=(.?) ; USER=(.?) ; COMMAND=(.*?)$" />

all that I get is still:

2012-03-16 09:35:49,003 DEBUG [Syslog Event Receiver[0.0.0.0:10514]] SyslogReceiver: Wating on a datagram to arrive
2012-03-16 09:35:49,009 DEBUG [SyslogConnection] ConvertToEvent: Converting to event: org.opennms.netmgt.syslogd.ConvertToEvent@4048cfeb[Sender=petrus....,Port=52058,Acknowledged Events=[],Event=<null>]
2012-03-16 09:35:49,013 TRACE [SyslogConnection] CustomSyslogParser: priority code = 81
2012-03-16 09:35:49,013 TRACE [SyslogConnection] CustomSyslogParser: message = Mar 16 09:36:00 petrus sudo: cyrille : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/cyrille ; USER=root ; COMMAND=/usr/bin/vi /etc/aliases
2012-03-16 09:35:49,014 TRACE [SyslogConnection] CustomSyslogParser: stdMsg = true
2012-03-16 09:35:49,014 TRACE [SyslogConnection] CustomSyslogParser: timestamp = Mar 16 09:36:00
2012-03-16 09:35:49,015 DEBUG [SyslogConnection] CustomSyslogParser: Unable to parse date 'Mar 16 09:36:00'
java.text.ParseException: Unparseable date: "Mar 16 09:36:00"
at java.text.DateFormat.parse(DateFormat.java:337)
at org.opennms.netmgt.syslogd.SyslogParser.parseDate(SyslogParser.java:119)
at org.opennms.netmgt.syslogd.CustomSyslogParser.parse(CustomSyslogParser.java:139)
at org.opennms.netmgt.syslogd.ConvertToEvent.make(ConvertToEvent.java:200)
at org.opennms.netmgt.syslogd.ConvertToEvent.make(ConvertToEvent.java:139)
at org.opennms.netmgt.syslogd.SyslogConnection.run(SyslogConnection.java:107)
at java.lang.Thread.run(Thread.java:662)
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: message = petrus sudo: cyrille : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/cyrille ; USER=root ; COMMAND=/usr/bin/vi /etc/aliases
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: pattern = ^((.+?) (.*))\n?$
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: host group = 2
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: message group = 3
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: Syslog message 'petrus sudo: cyrille : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/cyrille ; USER=root ; COMMAND=/usr/bin/vi /etc/aliases' matched regexp '^((.+?) (.*))\n?$'
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: Found host 'petrus'
2012-03-16 09:35:49,015 TRACE [SyslogConnection] CustomSyslogParser: Found message 'sudo: cyrille : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/cyrille ; USER=root ; COMMAND=/usr/bin/vi /etc/aliases'
2012-03-16 09:35:49,015 DEBUG [SyslogConnection] ConvertToEvent: got syslog message org.opennms.netmgt.syslogd.SyslogMessage@5b85ec5d[facility=authpriv,severity=Alert,version=<null>,date=<null>,hostname=petrus,message ID=<null>,process name=sudo,process ID=0,message=cyrille : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/cyrille ; USER=root ; COMMAND=/usr/bin/vi /etc/aliases]

I will be in training for the next 4 hours, but will try to catch you on IRC afterwards.

BR,

Cyrille