From f058574fcde08bf92ab8f1ba3a70c16ad1fb163c Mon Sep 17 00:00:00 2001
From: Bryan Davis <bd808@wikimedia.org>
Date: Mon, 9 Feb 2015 22:38:26 -0700
Subject: [PATCH] Add Monolog handler for syslog UDP transport

The stock Monolog\Handler\SyslogUdpHandler only works with a specifically
tailored Formatter class and it's output cannot be fed directly into
Logstash's syslog input. This handler implements RFC 3164 in a way that
can be used with any Formatter and parsed directly by Logstash.

Bug: T88870
Change-Id: Ib098d5cb8fe9643742360bf51b54fc0e27996c0f
---
 autoload.php                                  |  1 +
 .../debug/logger/monolog/SyslogHandler.php    | 94 +++++++++++++++++++
 2 files changed, 95 insertions(+)
 create mode 100644 includes/debug/logger/monolog/SyslogHandler.php

diff --git a/autoload.php b/autoload.php
index 5c515a0103..4607ba48c1 100644
--- a/autoload.php
+++ b/autoload.php
@@ -699,6 +699,7 @@ $wgAutoloadLocalClasses = array(
 	'MWLoggerMonologProcessor' => __DIR__ . '/includes/debug/logger/monolog/Processor.php',
 	'MWLoggerMonologSamplingHandler' => __DIR__ . '/includes/debug/logger/monolog/SamplingHandler.php',
 	'MWLoggerMonologSpi' => __DIR__ . '/includes/debug/logger/monolog/Spi.php',
+	'MWLoggerMonologSyslogHandler' => __DIR__ . '/includes/debug/logger/monolog/SyslogHandler.php',
 	'MWLoggerNullSpi' => __DIR__ . '/includes/debug/logger/NullSpi.php',
 	'MWLoggerSpi' => __DIR__ . '/includes/debug/logger/Spi.php',
 	'MWMemcached' => __DIR__ . '/includes/objectcache/MemcachedClient.php',
diff --git a/includes/debug/logger/monolog/SyslogHandler.php b/includes/debug/logger/monolog/SyslogHandler.php
new file mode 100644
index 0000000000..50c2fb5cd8
--- /dev/null
+++ b/includes/debug/logger/monolog/SyslogHandler.php
@@ -0,0 +1,94 @@
+<?php
+/**
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ * http://www.gnu.org/copyleft/gpl.html
+ *
+ * @file
+ */
+
+use Monolog\Handler\SyslogUdpHandler;
+use Monolog\Logger;
+
+/**
+ * Log handler that supports sending log events to a syslog server using RFC
+ * 3164 formatted UDP packets.
+ *
+ * Monolog's SyslogUdpHandler creates a partial RFC 5424 header (PRI and
+ * VERSION) and relies on the associated formatter to complete the header and
+ * message payload. This makes using it with a fixed format formatter like
+ * Monolog\Formatter\LogstashFormatter impossible. Additionally, the direct
+ * syslog input for Logstash only handles RFC 3164 syslog packets.
+ *
+ * This Handler should work with any Formatter. The formatted message will be
+ * prepended with an RFC 3164 message header and a partial message body. The
+ * resulting packet will looks something like:
+ *
+ *   <PRI>DATETIME HOSTNAME PROGRAM: MESSAGE
+ *
+ * This format works as input to rsyslog and can also be processed by the
+ * default Logstash syslog input handler.
+ *
+ * @since 1.25
+ * @author Bryan Davis <bd808@wikimedia.org>
+ * @copyright © 2015 Bryan Davis and Wikimedia Foundation.
+ */
+class MWLoggerMonologSyslogHandler extends SyslogUdpHandler {
+
+	/**
+	 * @var string $appname
+	 */
+	private $appname;
+
+	/**
+	 * @var string $hostname
+	 */
+	private $hostname;
+
+
+	/**
+	 * @param string $appname Application name to report to syslog
+	 * @param string $host Syslog host
+	 * @param int $port Syslog port
+	 * @param int $facility Syslog message facility
+	 * @param string $level The minimum logging level at which this handler
+	 *   will be triggered
+	 * @param bool $bubble Whether the messages that are handled can bubble up
+	 *   the stack or not
+	 */
+	public function __construct(
+		$appname,
+		$host,
+		$port = 514,
+		$facility = LOG_USER,
+		$level = Logger::DEBUG,
+		$bubble = true
+	) {
+		parent::__construct( $host, $port, $facility, $level, $bubble );
+		$this->appname = $appname;
+		$this->hostname = php_uname( 'n' );
+	}
+
+	protected function makeCommonSyslogHeader( $severity ) {
+		$pri = $severity + $this->facility;
+
+		// Goofy date format courtesy of RFC 3164 :(
+		// RFC 3164 actually specifies that the day of month should be space
+		// padded rather than unpadded but this seems to work with rsyslog and
+		// Logstash.
+		$timestamp = date( 'M j H:i:s' );
+
+		return "<{$pri}>{$timestamp} {$this->hostname} {$this->appname}: ";
+	}
+}
-- 
2.20.1