Module Syslog_message

Syslog message parser and unparser

Syslog-message is a module for handling syslog messages, as defined in RFC 3164.

The parse function transforms a string to a syslog message t, using a context of default parameters. Such a message can be transformed into a string to_string or pretty printed pp_string, pp.

1.2.0 - homepage

type facility =
  1. | Kernel_Message
  2. | User_Level_Messages
  3. | Mail_System
  4. | System_Daemons
  5. | Security_Authorization_Messages
  6. | Messages_Generated_Internally_By_Syslogd
  7. | Line_Printer_Subsystem
  8. | Network_News_Subsystem
  9. | UUCP_subsystem
  10. | Clock_Daemon
  11. | Security_Authorization_Messages_10
  12. | Ftp_Daemon
  13. | Ntp_Subsystem
  14. | Log_Audit
  15. | Log_Alert
  16. | Clock_Daemon_15
  17. | Local0
  18. | Local1
  19. | Local2
  20. | Local3
  21. | Local4
  22. | Local5
  23. | Local6
  24. | Local7

The type for Facilities

val int_of_facility : facility -> int
val facility_of_int : int -> facility option
val string_of_facility : facility -> string

string_of_facility f is data, the string representation of f.

val pp_print_facility : Stdlib.Format.formatter -> facility -> unit
type severity =
  1. | Emergency
  2. | Alert
  3. | Critical
  4. | Error
  5. | Warning
  6. | Notice
  7. | Informational
  8. | Debug

The type for Severity levels

val int_of_severity : severity -> int
val severity_of_int : int -> severity option
val string_of_severity : severity -> string

string_of_severity s is data, the string representation of s.

val pp_print_severity : Stdlib.Format.formatter -> severity -> unit
type ctx = {
  1. timestamp : Ptime.t;
  2. hostname : string;
  3. set_hostname : bool;
}

ctx provides additional information to the parse function in case one of the sub-parsers fails.

  • timestamp: A timestamp
  • hostname: Hostname, IPv4 or IPv6 address of the sender. "-" if unknown.
  • set_hostname: If true, the parse function will skip its hostname sub-parser and use the hostname from ctx instead.

set_hostname is automatically set by the timestamp sub-parser when it fails, because at this point it is no longer possible to determine the hostname from the input string.

type t = {
  1. facility : facility;
  2. severity : severity;
  3. timestamp : Ptime.t;
  4. hostname : string;
  5. tag : string;
  6. content : string;
}

The type for Syslog messages

val pp : Stdlib.Format.formatter -> t -> unit

pp ppf t prints the syslog message t on ppf.

val to_string : t -> string

to_string t is str, a pretty printed string of syslog message t.

val decode : ctx:ctx -> string -> (t, [> `Msg of string ]) Stdlib.result

decode ~ctx data is t, either Ok t, a successfully decoded syslog message, or Error e.

val encode : ?len:int -> t -> string

encode ~len t is data, the encoded syslog message t, truncated to len bytes. If len is 0 the output is not truncated.

Warning: Since version 1.0.0, messages are no longer truncated to 1024 bytes by default.

val encode_local : ?len:int -> t -> string

encode_local ~len t behaves as encode except that the message is formatted for sending to the local syslog daemon (e.g. on /dev/log).

module Rfc3164_Timestamp : sig ... end

RFC 3164 Timestamps