<commit_before>'use strict';

var extend = require(__dirname + '/../../prototype.js').extend;

exports.SyslogParser = extend({name: 'Syslog', humanName: 'Syslog'}, {

  parse: function(log) {
    return this.namedCapture(
      log,
      // From fluentd-0.10.9/lib/fluent/parser.rb:
      '^(?<time>[^ ]+\\s+[^ ]+ [^ ]+) (?<host>[^ ]*) (?<ident>[^:\\]]+)(\\[(?<pid>[0-9]+)\\])?: (?<message>.*)$'
    );
  },

  buildTemplateContext: function(template, log) {
    if ('full' == template) {
      return log;
    }

    delete log.pid;
    return log;
  },

  /**
   * @param now {Object} (Parser-specific, Test-only) Date instance.
   */
  extractTime: function(log, now) {
    // For unit testing.
    if (undefined === now) {
      now = new Date();
    }

    var matches = log.time.match(/^([A-Za-z]+)\s+(\d+) (\d{2}:\d{2}:\d{2})/);
    if (!matches) {
      return NaN;
    }

    var parsable = util.format(
      '%d/%d/%d %s',
      mainevent.shared.Date.monthNameToNum(matches[1]),
      matches[2],
      now.getFullYear(), // syslog dates do not include years
      matches[3]
    );
    var parsed = Date.parse(parsable);

    // Support logs from the prior year, e.g. importing Dec 31 lines on Jan 1.
    // Assumes current host and source host are time synchronized and log times
    // will always be in the past.
    if (parsed > now.getTime()) {
      parsable = util.format(
        '%d/%d/%d %s',
        mainevent.shared.Date.monthNameToNum(matches[1]),
        matches[2],
        now.getFullYear() - 1,  // Current year is in the future, try last year.
        matches[3]
      );
      parsed = Date.parse(parsable);
    }<commit_msg>MODIFY Syslog parser to ASSUME UTC system TZ<commit_after>'use strict';

var extend = require(__dirname + '/../../prototype.js').extend;

exports.SyslogParser = extend({name: 'Syslog', humanName: 'Syslog'}, {

  parse: function(log) {
    return this.namedCapture(
      log,
      // From fluentd-0.10.9/lib/fluent/parser.rb:
      '^(?<time>[^ ]+\\s+[^ ]+ [^ ]+) (?<host>[^ ]*) (?<ident>[^:\\]]+)(\\[(?<pid>[0-9]+)\\])?: (?<message>.*)$'
    );
  },

  buildTemplateContext: function(template, log) {
    if ('full' == template) {
      return log;
    }

    delete log.pid;
    return log;
  },

  /**
   * Warning: Assumes system timezone is UTC.
   *
   * @param now {Object} (Parser-specific, Test-only) Date instance.
   */
  extractTime: function(log, now) {
    // For unit testing.
    if (undefined === now) {
      now = new Date();
    }

    var matches = log.time.match(/^([A-Za-z]+)\s+(\d+) (\d{2}:\d{2}:\d{2})/);
    if (!matches) {
      return NaN;
    }

    var template = '%d/%d/%d %s UTC';

    var parsable = util.format(
      template,
      mainevent.shared.Date.monthNameToNum(matches[1]),
      matches[2],
      now.getFullYear(), // syslog dates do not include years
      matches[3]
    );
    var parsed = Date.parse(parsable);

    // Support logs from the prior year, e.g. importing Dec 31 lines on Jan 1.
    // Assumes current host and source host are time synchronized and log times
    // will always be in the past.
    if (parsed > now.getTime()) {
      parsable = util.format(
        template,
        mainevent.shared.Date.monthNameToNum(matches[1]),
        matches[2],
        now.getFullYear() - 1,  // Current year is in the future, try last year.
        matches[3]
      );
      parsed = Date.parse(parsable);
    }
{'fraction_non_alphanumeric': 0.18686131386861313, 'fraction_numerical': 0.011094890510948904, 'mean_word_length': 2.372047244094488, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7533892', 'n_tokens_mistral': 1213, 'n_tokens_neox': 1158, 'n_words': 286}