[plaso] Adding ChromeOS Sylog Support. #156

[plaso] Adding ChromeOS Sylog Support. #156

[james.nettesheim, 2016-12-08 04:22:08]

Code updated.

[james.nettesheim, 2016-12-08 04:25:25]

I've thought about a few different regexes and trying to remove regex style
verification altogether, let me know your thoughts.

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py
File plaso/parsers/syslog.py (right):

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py#n...
plaso/parsers/syslog.py:61: re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.'
I thought about this as well, but seems pretty difficult to grok quickly:

re.compile(r'^\d{{4}}-\d{{2}}-\d{{2}}T\d{{2}}:\d{{2}}:\d{{2}}\.'
           r'\d{{6}}[\+|-]\d{{2}}:\d{{2}}\s({0:s})'
           .format('|'.join(_SYSLOG_SEVERITY)))

[Joachim Metz, 2016-12-21 09:34:00]

Minor comments, mostly looks good

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py
File plaso/parsers/syslog.py (right):

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py#n...
plaso/parsers/syslog.py:61: re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.'
Maybe add comments explaining the expression? or break up the expression and
group them in a single expression?

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py#n...
plaso/parsers/syslog.py:96: u'iso_8601_offset' : pyparsing.oneOf(_OFFSET_PREFIX)
+
I opt to match the style of the rest of the code and continue with 4 space
indented code instead of forming a block on the right side of the file.

[james.nettesheim, 2016-12-27 05:10:29]

Code updated.

[james.nettesheim, 2016-12-27 05:11:52]

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py
File plaso/parsers/syslog.py (right):

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py#n...
plaso/parsers/syslog.py:61: re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.'
On 2016/12/21 09:34:00, Joachim Metz wrote:
> Maybe add comments explaining the expression? or break up the expression and
> group them in a single expression?

Done.

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py#n...
plaso/parsers/syslog.py:96: u'iso_8601_offset' : pyparsing.oneOf(_OFFSET_PREFIX)
+
On 2016/12/21 09:34:00, Joachim Metz wrote:
> I opt to match the style of the rest of the code and continue with 4 space
> indented code instead of forming a block on the right side of the file.

Changing this failed lint errors, do you want me to try to work around those, by
refactoring a bit?

[Joachim Metz, 2016-12-30 14:20:53]

Changes have been merged

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py
File plaso/parsers/syslog.py (right):

https://codereview.appspot.com/315950043/diff/20001/plaso/parsers/syslog.py#n...
plaso/parsers/syslog.py:96: u'iso_8601_offset' : pyparsing.oneOf(_OFFSET_PREFIX)
+
I've fixed this in the merge

[Joachim Metz, 2016-12-30 14:22:31]

LGTM, and merged.