Brent Halsey created FLUME-1277:
-----------------------------------
Summary: Error parsing Syslog rfc 3164 messages with null values
Key: FLUME-1277
URL: https://issues.apache.org/jira/browse/FLUME-1277
Project: Flume
Issue Type: Bug
Components: Sinks+Sources
Affects Versions: v1.1.0
Reporter: Brent Halsey
Priority: Minor
The SyslogUtils class doesn't properly parse rfc 3164 style messages containing
a null (hyphen) value. e.g.,
<10>Apr 1 13:14:04 ubuntu-11.cloudera.com - rest_of_message
It tries to parse it as a 5424 style message, skips over the date information,
and interprets the first hyphen as a null timestamp. Part of the problem is
the use of a Scanner and regex. This skips over a properly formatted 3164
style message until it finds anything that matches the 5424 regex, including a
hyphen.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
