fix(logs): recognize the IOS timestamp options Cisco documents

Cisco documents the IOS header as

    seq no:timestamp: %facility-severity-MNEMONIC:description

where everything before the '%' varies with "service timestamps log
[datetime|uptime] [msec] [localtime] [show-timezone]". Three of those options
produced a header the parser could not read.

show-timezone appends the zone name directly after the seconds, which lands in
the TAG position:

    <187>Mar  1 18:46:11 UTC: %LINK-3-UPDOWN: Interface Serial0 up

That parsed without error and set APP-NAME to "UTC", so every device sharing a
timezone would route under a service named after it -- a misattribution with
nothing to signal it, which is the failure this package is most concerned with.
Absorb the zone into the TIMESTAMP instead. The test is narrow on purpose: two
to five uppercase letters, terminated by a colon, and only when a Cisco
mnemonic follows. Without that last condition a short uppercase TAG such as
"GW: session opened" would be swallowed.

msec appends fractional seconds, which is the shape Cisco's own Embedded
Syslog Manager guide prints ("Mar 18 14:52:10.039:%LINK-5-CHANGED: ..."). The
timestamp matched only its 15-byte prefix, leaving the parse to fail on the
'.'; the message survived, since the wrapper always transmits the raw line, but
it lost its sub-second precision, was flagged as a parse error, and had any
CEF or LEEF payload inside it discarded. Accept the fraction on all four BSD
layouts, as isoTimestampLen already did on the ISO ones.

Cisco defines a leading '*' as meaning the clock never synchronized to a
reliable source. Step over it so the header behind it parses. The marker is not
kept in the TIMESTAMP, where it would defeat any downstream time parse; it
stays visible in the content, which is transmitted verbatim.

Uptime timestamps ("00:00:46:", "1w2d:") are deliberately left alone. They are
time since reboot rather than wall clock, so there is nothing to extract and
passing the line to MSG is already correct.

benchstat over eight runs: geomean +0.01%, allocations unchanged. Parse_BSD
alone shows +4.7% that I could not attribute -- ParseBSDLine exercises nearly
the same path at +0.8% -- and it is likely code layout.

Author: ddrthall

pkg/logs/internal/parsers/syslog/syslog.go

@@ -215,6 +215,11 @@ func Parse(line []byte) (SyslogMessage, error) {
 		}
 	case (b >= 'A' && b <= 'Z') || (b >= 'a' && b <= 'z'):
 		msg, err = parseBSD(line, pri, pos)
+	case b == '*':
+		// Cisco IOS marks an unsynchronized clock with '*' before the
+		// TIMESTAMP. parseBSD steps over it; if no timestamp follows it falls
+		// back to treating the remainder as MSG.
+		msg, err = parseBSD(line, pri, pos)
 	default:
 		// RFC 3164 §4.3.2: valid PRI, but what follows is neither a digit
 		// (RFC 5424 VERSION) nor a letter (BSD TIMESTAMP month). Treat the
@@ -444,7 +449,29 @@ func parseBSD(line []byte, pri int, pos int) (SyslogMessage, error) {
 	// Cisco ASA/FTD and Picus send in place of the BSD form. The ISO layout also
 	// turns up in tailed files regardless of sender, because rsyslog's default
 	// file template renders the timestamp as RFC 3339 and drops the PRI.
+	// Cisco IOS writes '*' ahead of the TIMESTAMP when the system clock has
+	// never synchronized to a reliable source. It is a marker rather than part
+	// of the time, so step over it and record the timestamp itself; the '*'
+	// stays visible in the content, which is transmitted verbatim. Only skip it
+	// when a timestamp actually follows, so a body opening with '*' is left as
+	// MSG.
+	if pos < len(line) && line[pos] == '*' {
+		if n, _ := timestampLen(line[pos+1:]); n > 0 {
+			pos++
+		}
+	}
+
 	tsLen, isISOTimestamp := timestampLen(line[pos:])
+	if !isISOTimestamp && tsLen > 0 {
+		// "show-timezone" appends the zone name to the BSD layouts. It belongs
+		// to the timestamp, not to the TAG position it occupies. A zone opens
+		// with an uppercase letter and an ordinary HOSTNAME almost never does,
+		// so that byte is tested before the call rather than inside it.
+		if end := pos + tsLen; end+1 < len(line) &&
+			line[end] == ' ' && line[end+1] >= 'A' && line[end+1] <= 'Z' {
+			tsLen += bsdZoneSuffixLen(line[end:])
+		}
+	}
 	if tsLen == 0 {
 		if pos < len(line) && pri >= 0 {
 			// RFC 3164 §4.3.2: valid PRI, content present but no valid
@@ -787,24 +814,90 @@ func bsdTimestampLen(b []byte) int {
 	// opens with a month abbreviation. One look at the first byte therefore
 	// picks the family, and the abbreviation is validated once rather than
 	// once per layout.
+	n := 0
 	if isDigit(b[0]) {
-		if isValidBSDTimestampYearFirst(b) {
-			return 20
+		if !isValidBSDTimestampYearFirst(b) {
+			return 0
 		}
+		n = 20
+	} else {
+		if !isValidMonthAbbrev(b) {
+			return 0
+		}
+		switch {
+		case isValidBSDTimestamp(b):
+			n = 15
+		case isValidBSDTimestampSingleSpaceDay(b):
+			n = 14
+		case isValidBSDTimestampWithYear(b):
+			n = 20
+		default:
+			return 0
+		}
+	}
+	// Every layout ends in seconds, so an optional fraction attaches the same
+	// way to all of them. The '.' is tested here so the common case of a
+	// timestamp without one costs a single comparison.
+	if len(b) > n && b[n] == '.' {
+		n += bsdFractionLen(b[n:])
+	}
+	return n
+}
+
+// bsdFractionLen returns the length of a fractional-seconds suffix — '.' and at
+// least one digit — at the start of b, or 0 if there is none. Cisco IOS appends
+// one under "service timestamps log datetime msec" ("Mar 18 14:52:10.039"),
+// which its own documentation uses throughout. Every BSD layout ends in seconds,
+// so the suffix attaches the same way to all of them, and isoTimestampLen
+// already accepts the equivalent on the ISO layouts.
+func bsdFractionLen(b []byte) int {
+	if len(b) < 2 || b[0] != '.' || !isDigit(b[1]) {
 		return 0
 	}
-	if !isValidMonthAbbrev(b) {
+	i := 2
+	for i < len(b) && isDigit(b[i]) {
+		i++
+	}
+	return i
+}
+
+// maxZoneAbbrevLen bounds a timezone abbreviation. Four letters covers the
+// longest in common use ("AEDT", "CEST"); five leaves room to spare.
+const maxZoneAbbrevLen = 5
+
+// bsdZoneSuffixLen returns the length of a " ZONE" suffix following a BSD
+// TIMESTAMP, or 0 if there is none. Cisco IOS appends the zone name under
+// "service timestamps log datetime show-timezone", putting it exactly where a
+// TAG would sit:
+//
+//	Mar  1 18:46:11 UTC: %LINK-3-UPDOWN: Interface Serial0 up
+//
+// Read as a TAG it becomes the APP-NAME, which then drives service routing from
+// a timezone. A bare uppercase token is far too weak a signal to act on, so the
+// suffix only counts when a Cisco mnemonic follows the colon that ends it —
+// leaving a genuine uppercase TAG ("GW: session opened") alone. The colon itself
+// is left in place for skipCiscoSeparator.
+func bsdZoneSuffixLen(b []byte) int {
+	// A lowercase byte here is the overwhelmingly common case — an ordinary
+	// HOSTNAME — so it is rejected before anything else runs.
+	if len(b) < 2 || b[0] != ' ' || b[1] < 'A' || b[1] > 'Z' {
 		return 0
 	}
-	switch {
-	case isValidBSDTimestamp(b):
-		return 15
-	case isValidBSDTimestampSingleSpaceDay(b):
-		return 14
-	case isValidBSDTimestampWithYear(b):
-		return 20
-	}
-	return 0
+	i := 1
+	for i < len(b) && i-1 < maxZoneAbbrevLen && b[i] >= 'A' && b[i] <= 'Z' {
+		i++
+	}
+	if i-1 < 2 || i >= len(b) || b[i] != ':' {
+		return 0
+	}
+	rest := b[i+1:]
+	for len(rest) > 0 && rest[0] == ' ' {
+		rest = rest[1:]
+	}
+	if !startsWithCiscoMnemonic(rest) {
+		return 0
+	}
+	return i
 }
 
 // timestampLen returns the length of the TIMESTAMP at the start of b and

pkg/logs/internal/parsers/syslog/timestamp_variants_test.go

@@ -210,6 +210,66 @@ func TestParseUnrecognizedTimestampLayouts(t *testing.T) {
 			procid:    nilvalue,
 			msg:       ": %FTD-6-305012: Teardown dynamic UDP translation",
 		},
+		{
+			// Cisco documents the IOS header as
+			// "seq no:timestamp: %facility-severity-MNEMONIC:description", the
+			// part before the '%' varying with "service timestamps log". The
+			// msec option is what its own Embedded Syslog Manager guide prints:
+			// "000013: Mar 18 14:52:10.039:%LINK-5-CHANGED: ...". Without the
+			// fractional seconds the timestamp ends mid-token and the header
+			// fails to parse at all.
+			name:      "cisco ios datetime msec",
+			line:      "<187>Mar 18 14:52:10.039: %LINK-5-CHANGED: Interface Serial3/3, changed state to administratively down",
+			timestamp: "Mar 18 14:52:10.039",
+			hostname:  nilvalue,
+			appname:   nilvalue,
+			procid:    nilvalue,
+			msg:       "%LINK-5-CHANGED: Interface Serial3/3, changed state to administratively down",
+		},
+		{
+			// The same guide prints no space between the colon and the '%'.
+			name:      "cisco ios datetime msec, no space before mnemonic",
+			line:      "<187>Mar 18 14:52:10.039:%LINK-5-CHANGED: Interface Serial3/3, changed state",
+			timestamp: "Mar 18 14:52:10.039",
+			hostname:  nilvalue,
+			appname:   nilvalue,
+			procid:    nilvalue,
+			msg:       "%LINK-5-CHANGED: Interface Serial3/3, changed state",
+		},
+		{
+			// "service timestamps log datetime show-timezone" appends the zone
+			// name, which lands in the TAG position. Read as a TAG it becomes
+			// the APP-NAME, so every device in a given zone would route under
+			// a service named after its timezone.
+			name:      "cisco ios show-timezone",
+			line:      "<187>Mar  1 18:46:11 UTC: %LINK-3-UPDOWN: Interface Serial0, changed state to up",
+			timestamp: "Mar  1 18:46:11 UTC",
+			hostname:  nilvalue,
+			appname:   nilvalue,
+			procid:    nilvalue,
+			msg:       "%LINK-3-UPDOWN: Interface Serial0, changed state to up",
+		},
+		{
+			name:      "cisco ios msec and show-timezone together",
+			line:      "<187>Mar 18 14:52:10.039 CEST: %LINK-5-CHANGED: Interface Serial3/3, changed state",
+			timestamp: "Mar 18 14:52:10.039 CEST",
+			hostname:  nilvalue,
+			appname:   nilvalue,
+			procid:    nilvalue,
+			msg:       "%LINK-5-CHANGED: Interface Serial3/3, changed state",
+		},
+		{
+			// Cisco documents '*' before the time as meaning the system clock
+			// never synchronized to a reliable source. It is a marker, not part
+			// of the time, and the header behind it parses normally.
+			name:      "cisco ios unsynchronized clock marker",
+			line:      "<187>*Mar  1 18:46:11.000: %LINK-3-UPDOWN: Interface Serial0, changed state to up",
+			timestamp: "Mar  1 18:46:11.000",
+			hostname:  nilvalue,
+			appname:   nilvalue,
+			procid:    nilvalue,
+			msg:       "%LINK-3-UPDOWN: Interface Serial0, changed state to up",
+		},
 	}
 
 	for _, tc := range cases {
@@ -231,6 +291,87 @@ func TestParseUnrecognizedTimestampLayouts(t *testing.T) {
 	}
 }
 
+// Absorbing a timezone name into the TIMESTAMP is only safe while it stays
+// narrow. An uppercase token after the time is otherwise indistinguishable from
+// a short TAG or a hostname, so nothing here may be given up to recognize a
+// zone: the Cisco mnemonic behind the colon is the whole justification.
+func TestTimezoneSuffixDoesNotEatTags(t *testing.T) {
+	cases := []struct {
+		name      string
+		line      string
+		timestamp string
+		hostname  string
+		appname   string
+		msg       string
+	}{
+		{
+			// Shaped exactly like the zone case but without a mnemonic, so the
+			// token is a TAG and has to stay one.
+			name:      "uppercase tag is not a timezone",
+			line:      "<134>Jan  1 00:00:00 GW: session opened for user root",
+			timestamp: "Jan  1 00:00:00",
+			hostname:  nilvalue,
+			appname:   "GW",
+			msg:       "session opened for user root",
+		},
+		{
+			// A zone-shaped token in the HOSTNAME position with no colon is a
+			// hostname, whatever it is named.
+			name:      "zone-shaped hostname is left alone",
+			line:      "<134>Feb 10 12:00:00 UTC sshd: not a mnemonic body",
+			timestamp: "Feb 10 12:00:00",
+			hostname:  "UTC",
+			appname:   "sshd",
+			msg:       "not a mnemonic body",
+		},
+		{
+			// Only the token directly after the timestamp can be a zone; once a
+			// HOSTNAME has been read, the next one is a TAG.
+			name:      "zone-shaped tag after a hostname",
+			line:      "<134>Feb 10 12:00:00 myhost UTC: still a tag",
+			timestamp: "Feb 10 12:00:00",
+			hostname:  "myhost",
+			appname:   "UTC",
+			msg:       "still a tag",
+		},
+		{
+			// Fractional seconds end at the digits and must not run into the
+			// HOSTNAME behind them.
+			name:      "fraction does not consume the hostname",
+			line:      "<134>Feb 10 12:00:00.5 myhost sshd: ok",
+			timestamp: "Feb 10 12:00:00.5",
+			hostname:  "myhost",
+			appname:   "sshd",
+			msg:       "ok",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			msg, err := Parse([]byte(tc.line))
+			require.NoError(t, err)
+			assert.Equal(t, tc.timestamp, msg.Timestamp, "timestamp")
+			assert.Equal(t, tc.hostname, msg.Hostname, "hostname")
+			assert.Equal(t, tc.appname, msg.AppName, "appname")
+			assert.Equal(t, tc.msg, string(msg.Msg), "msg")
+		})
+	}
+}
+
+// '*' is only a clock marker when a timestamp follows it. Anywhere else it is
+// ordinary content and must reach MSG intact.
+func TestAsteriskWithoutTimestampIsContent(t *testing.T) {
+	for _, line := range []string{
+		"<134>*** ALERT *** disk full on /var",
+		"<134>*not a timestamp at all",
+	} {
+		msg, err := Parse([]byte(line))
+		require.NoError(t, err)
+		assert.Equal(t, nilvalue, msg.Timestamp)
+		assert.Equal(t, line[len("<134>"):], string(msg.Msg), "input %q", line)
+	}
+}
+
 // The colon ASA writes after an ISO timestamp is skipped whatever follows it,
 // not only a Cisco mnemonic. Every ASA and FTD sample happens to carry one, so
 // nothing else in the suite covers the general case: drop this handling and a
@@ -519,8 +660,39 @@ func TestBSDTimestampLen(t *testing.T) {
 		{"Jan 9 03-47-40", 0},
 		{"2024-04-04T08:05:06Z", 0},
 		{"", 0},
+
+		// Fractional seconds attach to every layout.
+		{"Mar 18 14:52:10.039", 19},
+		{"Jan 9 03:47:40.5", 16},
+		{"Apr 04 2024 08:05:06.123456", 27},
+		{"2024 Apr 04 08:05:06.039", 24},
+		{"Mar 18 14:52:10.", 15},    // '.' with no digits is not a fraction
+		{"Mar 18 14:52:10.x", 15},   // nor is a non-digit
+		{"Mar 18 14:52:10 UTC", 15}, // the zone is not part of the bare layout
 	}
 	for _, tc := range cases {
 		assert.Equal(t, tc.want, bsdTimestampLen([]byte(tc.in)), "input %q", tc.in)
 	}
 }
+
+func TestBSDZoneSuffixLen(t *testing.T) {
+	cases := []struct {
+		in   string
+		want int
+	}{
+		{" UTC: %LINK-3-UPDOWN: up", 4},
+		{" CEST: %ASA-6-302013: built", 5},
+		{" AEDT:%FTD-1-430003: x", 5},
+		{" UTC:   %SYS-5-CONFIG_I: x", 4}, // Cisco allows spaces after the colon
+		{" GW: session opened", 0},        // no mnemonic: a TAG, not a zone
+		{" UTC %LINK-3-UPDOWN: up", 0},    // no colon terminating the zone
+		{" U: %LINK-3-UPDOWN: up", 0},     // too short to be a zone
+		{" TOOLONGZONE: %LINK-3-UPDOWN: up", 0},
+		{" utc: %LINK-3-UPDOWN: up", 0}, // zone names are uppercase
+		{"UTC: %LINK-3-UPDOWN: up", 0},  // must be preceded by SP
+		{"", 0},
+	}
+	for _, tc := range cases {
+		assert.Equal(t, tc.want, bsdZoneSuffixLen([]byte(tc.in)), "input %q", tc.in)
+	}
+}