fix: parse PRI-less syslog file format; procid is an identifier (1.0.1)

[copyleftdev]

Two dogfood-found fixes from running 1.0.0 on the host's real /var/log/syslog.

1. Syslog file format (the real bug)

rsyslog/syslog-ng write /var/log/syslog without the <PRI> wire header — an ISO-8601 (or BSD) timestamp, then host + tag:

2026-06-01T09:14:57.403686-07:00 4ubox NetworkManager[3524]: <info> ...

The parser's sniff required <PRI>, so a real syslog file was misdetected as ini and collapsed to a single garbage row. Now recognized via syslog_loose extracting a timestamp (sniff also requires host+app, so a timestamp-leading CSV isn't grabbed); facility/severity are present only when a <PRI> is.

50,000 real lines: ini/1 row → syslog/50,000 rows.

2. procid is an identifier

The syslog procid column was classed a measurement, so PIDs were flagged as point outliers (~18,544 noise findings on the 50k syslog). procid joins the identifier name set → skipped like other ids → 1 finding.

Contract

Unchanged — tq1 / PROTOCOL / envelope shape all stable (this is a 1.0.1 patch). Goldens unaffected.

Gate

proptest + cargo-mutants 0 missed: syslog.rs (29 caught / 2 unviable), roles.rs (35 / 1). The one initially-missed &&-vs-|| guard mutant was eliminated by simplifying the parse guard to a single timestamp check — syslog_loose only yields a timestamp once it has also parsed the following host/tag, so the extra && hostname was redundant (and the mutant equivalent).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@copyleftdev, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 14 minutes and 53 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af7ac010-55df-44be-830f-c959e263a5de

📥 Commits

Reviewing files that changed from the base of the PR and between 67821d0 and 2001e37.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• CHANGELOG.md
• Cargo.toml
• crates/ax-core/src/roles.rs
• crates/ax-normalize/src/parsers/syslog.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/syslog-file-format

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}