parsing syslog levels - done

Author: Krusty84

pom.xml

@@ -74,6 +74,11 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-elytron-security-properties-file</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.antlr</groupId>
+            <artifactId>antlr4-runtime</artifactId>
+            <version>4.13.0</version>
+        </dependency>
         <!-- SMB Support -->
         <dependency>
             <groupId>eu.agno3.jcifs</groupId>
@@ -101,6 +106,28 @@
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.antlr</groupId>
+                <artifactId>antlr4-maven-plugin</artifactId>
+                <version>4.13.0</version>
+                <executions>
+                    <execution>
+                        <id>generate-antlr-sources</id>
+                        <phase>generate-sources</phase>
+                        <goals>
+                            <goal>antlr4</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/generated-sources/antlr</outputDirectory>
+                            <addOutputDirectory>true</addOutputDirectory>
+                            <arguments>
+                                <argument>-package</argument>
+                                <argument>com.krusty84.syslog.antlr</argument>
+                            </arguments>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>${quarkus.platform.group-id}</groupId>
                 <artifactId>quarkus-maven-plugin</artifactId>

src/main/antlr4/TcPulseSyslogLexer.g4

@@ -0,0 +1,6 @@
+lexer grammar TcPulseSyslogLexer;
+
+LEVEL   : 'INFO' | 'DEBUG' | 'NOTE' | 'WARN' | 'ERROR' | 'FATAL';
+NEWLINE : '\r'? '\n' -> skip;
+WS      : [ \t]+ -> skip;
+OTHER   : . -> skip;

src/main/java/com/krusty84/DatabaseService.java

@@ -25,6 +25,7 @@ public class DatabaseService {
 
     private final PmProcessListRepository processListRepo;
     private final PpomSessionRepository sessionRepo;
+    private final SyslogLevelCounter syslogLevelCounter;
 
     @ConfigProperty(name = "syslog.base.path", defaultValue = "/")
     String syslogBasePath;
@@ -47,9 +48,12 @@ public class DatabaseService {
     @ConfigProperty(name = "syslog.smb.password", defaultValue = "")
     String smbPassword;
 
-    public DatabaseService(PmProcessListRepository processListRepo, PpomSessionRepository sessionRepo) {
+    public DatabaseService(PmProcessListRepository processListRepo,
+                           PpomSessionRepository sessionRepo,
+                           SyslogLevelCounter syslogLevelCounter) {
         this.processListRepo = processListRepo;
         this.sessionRepo = sessionRepo;
+        this.syslogLevelCounter = syslogLevelCounter;
     }
 
     @Transactional
@@ -81,8 +85,22 @@ private LoggedUserData loggedJoinedData(Object[] row) {
         String syslogPath = (String) row[4];
 
         String loginDateIso = loginDate != null ? DateTimeFormatter.ISO_INSTANT.format(loginDate.toInstant()) : null;
+        SyslogLevelStats levels = resolveSyslogLevels(syslogPath);
 
-        return new LoggedUserData(processId, userName, nodeName, loginDateIso, syslogPath);
+        return new LoggedUserData(processId, userName, nodeName, loginDateIso, syslogPath, levels);
+    }
+
+    private SyslogLevelStats resolveSyslogLevels(String syslogPath) {
+        if (syslogPath == null || syslogPath.isBlank()) {
+            return SyslogLevelStats.empty();
+        }
+
+        try (InputStream stream = downloadSyslogFile(syslogPath)) {
+            return syslogLevelCounter.countLevels(stream);
+        } catch (Exception e) {
+            System.out.println("[DatabaseService] Unable to analyze syslog '" + syslogPath + "': " + e.getMessage());
+            return SyslogLevelStats.empty();
+        }
     }
 
     public InputStream getFileStream(String pmSyslogPath, long start, long length) throws Exception {

src/main/java/com/krusty84/LoggedUserData.java

@@ -5,6 +5,7 @@ public record LoggedUserData(
         String userName,
         String nodeName,
         String loginDateUtc,
-        String syslogPath
+        String syslogPath,
+        SyslogLevelStats levels
 ) {
-}
+}

src/main/java/com/krusty84/SyslogLevelCounter.java

@@ -0,0 +1,63 @@
+package com.krusty84;
+
+import com.krusty84.syslog.antlr.TcPulseSyslogLexer;
+import jakarta.enterprise.context.ApplicationScoped;
+import org.antlr.v4.runtime.CharStream;
+import org.antlr.v4.runtime.CharStreams;
+import org.antlr.v4.runtime.CommonTokenStream;
+import org.antlr.v4.runtime.Token;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+
+@ApplicationScoped
+public class SyslogLevelCounter {
+
+    public SyslogLevelStats countLevels(InputStream stream) {
+        if (stream == null) {
+            return SyslogLevelStats.empty();
+        }
+
+        try {
+            CharStream charStream = CharStreams.fromStream(stream, StandardCharsets.UTF_8);
+            TcPulseSyslogLexer lexer = new TcPulseSyslogLexer(charStream);
+            CommonTokenStream tokenStream = new CommonTokenStream(lexer);
+            tokenStream.fill();
+
+            long info = 0;
+            long debug = 0;
+            long note = 0;
+            long warn = 0;
+            long error = 0;
+            long fatal = 0;
+
+            List<Token> tokens = tokenStream.getTokens();
+            for (Token token : tokens) {
+                if (token.getType() == TcPulseSyslogLexer.LEVEL) {
+                    String text = token.getText();
+                    if (text == null) {
+                        continue;
+                    }
+                    switch (text) {
+                        case "INFO" -> info++;
+                        case "DEBUG" -> debug++;
+                        case "NOTE" -> note++;
+                        case "WARN" -> warn++;
+                        case "ERROR" -> error++;
+                        case "FATAL" -> fatal++;
+                        default -> {
+                            // ignore unexpected values
+                        }
+                    }
+                }
+            }
+
+            return new SyslogLevelStats(info, debug, note, warn, error, fatal);
+        } catch (IOException e) {
+            System.out.println("[TCPulse] Failed to parse syslog: " + e.getMessage());
+            return SyslogLevelStats.empty();
+        }
+    }
+}

src/main/java/com/krusty84/SyslogLevelStats.java

@@ -0,0 +1,13 @@
+package com.krusty84;
+
+public record SyslogLevelStats(long info,
+                               long debug,
+                               long note,
+                               long warn,
+                               long error,
+                               long fatal) {
+
+    public static SyslogLevelStats empty() {
+        return new SyslogLevelStats(0, 0, 0, 0, 0, 0);
+    }
+}

src/main/resources/application.properties

@@ -11,7 +11,7 @@ quarkus.http.auth.basic=true
 
 # Teamcenter based on PostgreSQL DB
 quarkus.datasource.db-kind=postgresql
-quarkus.datasource.jdbc.url=jdbc:postgresql://51.250.111.246:5432/tc
+quarkus.datasource.jdbc.url=jdbc:postgresql://89.169.183.86:5432/tc
 quarkus.datasource.username=infodba
 quarkus.datasource.password=infodba
 # Minimum server version Quarkus expects (override QUARKUS_DB_VERSION env var to match your server or switch to Oracle)