class Fluent::AuditdParser

Public Instance Methods

configure(conf={}) click to toggle source
Calls superclass method
# File lib/fluent/plugin/parser_auditd.rb, line 9
def configure(conf={})
  super
  @auditd = Auditd.new()
end
parse(text) { |time, parsed_line| ... } click to toggle source
# File lib/fluent/plugin/parser_auditd.rb, line 14
def parse(text)
  begin
    parsed_line = @auditd.parse_auditd_line text
    time = parsed_line.nil? ? nil : DateTime.parse(parsed_line['time']).to_time.to_f

    # debugging hack
    parsed_line = {"not" => "found"} if parsed_line.nil?
    time = 0 if parsed_line.nil?
    # end of debugging hack
    
    yield time, parsed_line
  rescue Fluent::Auditd::AuditdParserException => e
    log.error e.message
    yield nil, nil
  end
end