From 8d832e93f23bb88e4150858e4d1c1a05d413cf8a Mon Sep 17 00:00:00 2001
From: Mark Nellemann <mark.nellemann@gmail.com>
Date: Wed, 23 Sep 2020 07:01:55 +0200
Subject: [PATCH] Change options behavior. Parse RFC3164 timestamps as UTC.

---
 .../java/biz/nellemann/syslogd/SyslogParser.java     |  9 ++++-----
 .../java/biz/nellemann/syslogd/SyslogServer.java     | 12 ++++--------
 .../biz/nellemann/syslogd/SyslogParserTest.groovy    |  2 +-
 3 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/src/main/java/biz/nellemann/syslogd/SyslogParser.java b/src/main/java/biz/nellemann/syslogd/SyslogParser.java
index 0d28201..cee9237 100644
--- a/src/main/java/biz/nellemann/syslogd/SyslogParser.java
+++ b/src/main/java/biz/nellemann/syslogd/SyslogParser.java
@@ -42,7 +42,7 @@ public class SyslogParser {
         Matcher matcher = pattern.matcher(input);
         boolean matchFound = matcher.find();
         if(!matchFound) {
-            log.warn("Match not found");
+            log.warn("parseRfc3164() - Match not found in: " + input);
             return null;
         }
 
@@ -81,7 +81,7 @@ public class SyslogParser {
         Matcher matcher = pattern.matcher(input);
         boolean matchFound = matcher.find();
         if(!matchFound) {
-            log.warn("Match not found");
+            log.warn("parseRfc5424() - Match not found in: " + input);
             return null;
         }
 
@@ -132,7 +132,7 @@ public class SyslogParser {
     static protected Instant parseRfc3164Timestamp(String dateString) {
 
         // We need to add year to parse date correctly
-        LocalDateTime dt = LocalDateTime.now();
+        OffsetDateTime odt = OffsetDateTime.now();
 
         // Date: Mmm dd hh:mm:ss
         Instant instant = null;
@@ -140,8 +140,7 @@ public class SyslogParser {
             DateTimeFormatter dateTimeFormatter = DateTimeFormatter.ofPattern("yyyy MMM dd HH:mm:ss")
                 .withLocale(Locale.getDefault())
                 .withZone(ZoneId.systemDefault());
-            LocalDateTime dateTime = LocalDateTime.parse(dt.getYear() + " " + dateString, dateTimeFormatter);
-            instant = dateTime.toInstant(ZoneOffset.UTC);
+            instant = Instant.from(dateTimeFormatter.parse(odt.getYear() + " " + dateString));
         } catch(DateTimeParseException e) {
             log.error("parseDate()", e);
         }
diff --git a/src/main/java/biz/nellemann/syslogd/SyslogServer.java b/src/main/java/biz/nellemann/syslogd/SyslogServer.java
index 8307d7f..619e48d 100644
--- a/src/main/java/biz/nellemann/syslogd/SyslogServer.java
+++ b/src/main/java/biz/nellemann/syslogd/SyslogServer.java
@@ -36,13 +36,9 @@ public class SyslogServer implements Callable<Integer>, LogListener {
     @CommandLine.Option(names = "--no-tcp", negatable = true, description = "Listen on TCP, true by default.")
     boolean tcpServer = true;
 
-    @CommandLine.Option(names = "--rfc3164", negatable = true, description = "Parse RFC3164 syslog message, false by default.")
+    @CommandLine.Option(names = "--rfc3164", negatable = false, description = "Parse RFC3164 syslog message, RFC5424 by default.")
     boolean rfc3164 = false;
 
-    @CommandLine.Option(names = "--no-rfc5424", negatable = true, description = "Parse RFC5424 syslog message, true by default.")
-    boolean rfc5424 = true;
-
-
     public static void main(String... args) {
         int exitCode = new CommandLine(new SyslogServer()).execute(args);
         System.exit(exitCode);
@@ -74,10 +70,10 @@ public class SyslogServer implements Callable<Integer>, LogListener {
         String message = event.getMessage();
         SyslogMessage msg = null;
         try {
-            if(rfc5424) {
-                msg = SyslogParser.parseRfc5424(message);
-            } else if(rfc3164) {
+            if(rfc3164) {
                 msg = SyslogParser.parseRfc3164(message);
+            } else {
+                msg = SyslogParser.parseRfc5424(message);
             }
         } catch(Exception e) {
             log.error("Problem parsing message: ", e);
diff --git a/src/test/groovy/biz/nellemann/syslogd/SyslogParserTest.groovy b/src/test/groovy/biz/nellemann/syslogd/SyslogParserTest.groovy
index 5f046eb..aff97d6 100644
--- a/src/test/groovy/biz/nellemann/syslogd/SyslogParserTest.groovy
+++ b/src/test/groovy/biz/nellemann/syslogd/SyslogParserTest.groovy
@@ -16,7 +16,7 @@ class SyslogParserTest extends Specification {
         Instant inst = SyslogParser.parseRfc3164Timestamp(dateString)
 
         then:
-        inst.toString() == "${dt.getYear()}-09-12T22:50:13Z"
+        inst.toString() == "${dt.getYear()}-09-12T20:50:13Z"
     }
 
     void "test parseRfc5424Timestamp"() {