mariadb-audit-parser: improving syslog_info parsing

[gaborznagy]

No description provided.

[kira-syslogng]

Build SUCCESS

[bazsi]

can you elaborate why the change is needed? honestly don't see the reason. thanks.

[gaborznagy]

can you elaborate why the change is needed? honestly don't see the reason. thanks.

First, I've found that it can parse the syslog_info and the serverhost incorrectly:
before:

[2022-05-02T09:49:07.479268] Setting value; name='.mariadb.serverhost', value='eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0', type='string', msg='0x7fdc84024770'

with this patch:

[2022-05-02T09:47:30.122508] Setting value; name='.mariadb.serverhost', value='eff8a68bcd7f', type='string', msg='0x7f4164024770'

Details

with the fix

[2022-05-02T09:47:30.121853] Incoming log entry; line='<190>Apr 13 14:41:03 mysql-server_auditing:  eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0'

[2022-05-02T09:47:30.122022] Setting value; name='MESSAGE', value=' eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0', type='string', msg='0x7f4164024770'

[2022-05-02T09:47:30.122259] Setting value; name='.mariadb.serverhost', value=' eff8a68bcd7f', type='string', msg='0x7f4164024770'

2022-05-02T09:47:30.122423] regexp-parser message processing started; input=' eff8a68bcd7f', prefix='.mariadb.', msg='0x7f4164024770'
[2022-05-02T09:47:30.122432] regexp-parser message processing for; input=' eff8a68bcd7f', pattern='^\s*(?<syslog_info>\S*?)(?: )?(?<serverhost>\S+)$'
[2022-05-02T09:47:30.122475] Setting value; name='0', value=' eff8a68bcd7f', type='string', msg='0x7f4164024770'
[2022-05-02T09:47:30.122486] Setting value; name='1', value='', type='string', msg='0x7f4164024770'
[2022-05-02T09:47:30.122497] Setting value; name='2', value='eff8a68bcd7f', type='string', msg='0x7f4164024770'
[2022-05-02T09:47:30.122508] Setting value; name='.mariadb.serverhost', value='eff8a68bcd7f', type='string', msg='0x7f4164024770'
[2022-05-02T09:47:30.122520] Setting value; name='.mariadb.syslog_info', value='', type='string', msg='0x7f4164024770'

without the fix

[2022-05-02T09:49:07.478460] Incoming log entry; line='<190>Apr 13 14:41:03 mysql-server_auditing:  eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0'

[2022-05-02T09:49:07.478648] Setting value; name='MESSAGE', value=' eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0', type='string', msg='0x7fdc84024770'

[2022-05-02T09:49:07.478939] Setting value; name='.mariadb.serverhost', value=' eff8a68bcd7f', type='string', msg='0x7fdc84024770'

[2022-05-02T09:49:07.479127] regexp-parser message processing started; input=' eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0', prefix='.mariadb.', msg='0x7fdc84024770'
[2022-05-02T09:49:07.479143] regexp-parser message processing for; input=' eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0', pattern='^(?<syslog_info>.*) (?<serverhost>[^ ]*)$'
[2022-05-02T09:49:07.479205] Setting indirect value; msg='0x7fdc84024770', name='0', type='string', ref_handle='3', ofs='0', len='47'
[2022-05-02T09:49:07.479228] Setting indirect value; msg='0x7fdc84024770', name='1', type='string', ref_handle='3', ofs='0', len='0'
[2022-05-02T09:49:07.479246] Setting indirect value; msg='0x7fdc84024770', name='2', type='string', ref_handle='3', ofs='1', len='46'
[2022-05-02T09:49:07.479268] Setting value; name='.mariadb.serverhost', value='eff8a68bcd7f,user1,172.18.0.3,31,0,CONNECT,,,0', type='string', msg='0x7fdc84024770'
[2022-05-02T09:49:07.479290] Setting value; name='.mariadb.syslog_info', value='', type='string', msg='0x7fdc84024770'

Second, I wanted to optimize a little bit the regex and replace wildcard . matching with something a little bit more specific (\S), and I think focusing regexp-parser on the .serverhost field instead of using $MESSAGE as input is better.

[OverOrion]

LGTM!