fix: parse PRI-less syslog file format; procid is an identifier (1.0.1)#62
Conversation
Two dogfood-found fixes from running 1.0.0 on the host's real /var/log/syslog. 1. Syslog file format: rsyslog/syslog-ng write the file WITHOUT the <PRI> wire header (ISO-8601 or BSD timestamp, then host + tag). The parser's sniff required <PRI>, so a real /var/log/syslog was misdetected as `ini` and collapsed to one garbage row. Now recognized via syslog_loose extracting a timestamp (+host+app in the sniff, to not grab timestamp-leading CSVs); facility/severity present only when a <PRI> is. 50k lines: ini/1row → syslog/50k. 2. Column roles: `procid` (syslog's process-id column) was classed measurement, so PIDs were flagged as point outliers (~18.5k noise on the 50k syslog). Added `procid` to the identifier name set → skipped like other ids (→ 1 finding). Contract unchanged (tq1/PROTOCOL/envelope shape all stable). Gates: proptest + cargo-mutants 0-missed on syslog.rs (29 caught/2 unviable) and roles.rs (35/1); the `&&`-vs-`||` guard mutant was removed by simplifying to a single timestamp check (syslog_loose only yields a timestamp once host/tag also parsed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 14 minutes and 53 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Two dogfood-found fixes from running 1.0.0 on the host's real
/var/log/syslog.1. Syslog file format (the real bug)
rsyslog/syslog-ng write
/var/log/syslogwithout the<PRI>wire header — an ISO-8601 (or BSD) timestamp, then host + tag:The parser's
sniffrequired<PRI>, so a real syslog file was misdetected asiniand collapsed to a single garbage row. Now recognized viasyslog_looseextracting a timestamp (sniff also requires host+app, so a timestamp-leading CSV isn't grabbed);facility/severityare present only when a<PRI>is.50,000 real lines:
ini/1 row →syslog/50,000 rows.2.
procidis an identifierThe syslog
procidcolumn was classed ameasurement, so PIDs were flagged as point outliers (~18,544 noise findings on the 50k syslog).procidjoins the identifier name set → skipped like other ids → 1 finding.Contract
Unchanged —
tq1/PROTOCOL/ envelope shape all stable (this is a 1.0.1 patch). Goldens unaffected.Gate
proptest+cargo-mutants0 missed:syslog.rs(29 caught / 2 unviable),roles.rs(35 / 1). The one initially-missed&&-vs-||guard mutant was eliminated by simplifying the parse guard to a single timestamp check —syslog_looseonly yields a timestamp once it has also parsed the following host/tag, so the extra&& hostnamewas redundant (and the mutant equivalent).🤖 Generated with Claude Code