The flags field was added by kernel v3.6:
https://github.com/torvalds/linux/commit/
d39f3d77c9b1fe7cc33a14beb4a4849af0a4ac22
Now our baseline on the kernel is v5.4, so we can assume there exists
the flags field after the monotonic timestamp.
This also adds several short comments.
unsigned long long usec;
size_t n = 0, z = 0, j;
int priority, r;
- char *e, *f, *k;
+ char *e, *k;
uint64_t serial;
size_t pl;
int saved_log_max_level = INT_MAX;
if (l <= 0)
return;
+ /* syslog prefix including priority and facility */
e = memchr(p, ',', l);
if (!e)
return;
if (s->forward_to_kmsg && LOG_FAC(priority) != LOG_KERN)
return;
+ /* seqnum */
l -= (e - p) + 1;
p = e + 1;
e = memchr(p, ',', l);
*s->kernel_seqnum = serial + 1;
}
+ /* monotonic timestamp */
l -= (e - p) + 1;
p = e + 1;
- f = memchr(p, ';', l);
- if (!f)
- return;
- /* Kernel 3.6 has the flags field, kernel 3.5 lacks that */
e = memchr(p, ',', l);
- if (!e || f < e)
- e = f;
+ if (!e)
+ return;
*e = 0;
r = safe_atollu(p, &usec);
if (r < 0)
return;
- l -= (f - p) + 1;
- p = f + 1;
+ /* ignore flags and any other fields, and find the beginning of the message */
+ l -= (e - p) + 1;
+ p = e + 1;
+ e = memchr(p, ';', l);
+ if (!e)
+ return;
+
+ /* find the end of the message */
+ l -= (e - p) + 1;
+ p = e + 1;
e = memchr(p, '\n', l);
if (!e)
return;