Facility field shows severity value (and vice versa)

[megastef]

Hi, I think the output of 'severity' is actually the facility value.
And it would would be nice to have a mapping to text.

E.g. using this:

var SEVERITY = [
    'emerg',
    'alert',
    'crit',
    'err',
    'warning',
    'notice',
    'info',
    'debug'
  ]
  var FACILITY = [
    'kern',
    'user',
    'mail',
    'daemon',
    'auth',
    'syslog',
    'lpr',
    'news',
    'uucp',
    'cron',
    'authpriv',
    'ftp',
    'ntp',
    'logaudit',
    'logalert',
    'clock',
    'local0',
    'local1',
    'local2',
    'local3',
    'local4',
    'local5',
    'local6',
    'local7'
  ]

[meschbach]

Do you have a few example log entries and current parsing outputs I can take a look at?

[SpaceMacGyver]

The problem here lies in parsePRI:

function parsePRI(raw) {
    // PRI means Priority, includes Facility and Severity
    // e.g. 10110111 =  10110: facility 111: severity
    var binary = (~~raw).toString(2)
    var facility = parseInt(binary.substr(binary.length - 3), 2)
    var severity = parseInt(binary.substring(0, binary.length - 3), 2)
    return [facility, severity]
}

The comments indicate that the 5 higher bits (left-most 5 characters) are facility, and the 3 lower bits (right-most 3 chars) are the severity. However, the assignments to facility and severity have the opposite in their substring invocations (facility is assigned 3 rightmost chars, severity assigned everything to the left of that). Simply swapping variable names here would be sufficient to address this.

[gervasiocaj]

From the Syslog RFC:

The Priority value is calculated by first multiplying the Facility
number by 8 and then adding the numerical value of the Severity. For
example, a kernel message (Facility=0) with a Severity of Emergency
(Severity=0) would have a Priority value of 0. Also, a "local use 4"
message (Facility=20) with a Severity of Notice (Severity=5) would
have a Priority value of 165. In the PRI of a syslog message, these
values would be placed between the angle brackets as <0> and <165>
respectively. The only time a value of "0" follows the "<" is for
the Priority value of "0". Otherwise, leading "0"s MUST NOT be used.

Using the mentioned example, running parsePRI('165') results in [ 5, 20 ], when it should return [ 20, 5 ].

[srolija]

There is also an issue with padding since PRI can end up as binary only one or two characters long, substring on it ends up with an empty string which then returns NaN instead of 0.

As an example; following format header (generated by UFW block):

<4>May 29 14:52:40 myhost kernel

Is parsed as:

{
  facility: NaN,
  severity: 4,
...
}

When it should have been:

{
  facility: 0,
  severity: 4,
...
}

The fix should be fairly simple, we can just change the line 65 to fallback when it is NaN from:

var facility = parseInt(binary.substring(0, binary.length - 3), 2)

to:

var facility = parseInt(binary.substring(0, binary.length - 3), 2) || 0;