package Monitor::syslog;

require 5.001;

use strict;
use vars qw(@ISA @EXPORT $VERSION);
use Monitor::logfile;

@ISA = qw(Monitor::logfile);


sub decode {
    my( $self, $line ) = @_;
    my( @mon ) = ( "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep" , "Oct", "Nov", "Dec" );
    my( $daytime, $time, $host );
 
    print "syslog: decodeing ".$line."\n" if( $BigSister::common::dl>7 );
    if( $line =~ /^([A-Z][a-z][a-z])\s+(\d+)\s+([\d:]+)\s+([^\s]+) / ) {
	$line = lc($4)." ".$';
	$host = lc($4);
	my $now = time;
	my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($now);
	$daytime = $hour*3600+$min*60+$sec;
	my( $nowmon, $nowday ) = ( $mon[$mon], $mday );
	($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($now-24*3600);
	my( $beforemon, $beforeday ) = ( $mon[$mon], $mday );
	($mon,$mday,$time) = ($1,$2,$3);
	if( (($mon eq $beforemon) && ($mday == $beforeday)) ||
		(($mon eq $nowmon) && ($mday == $nowday)) ) {
	    ($hour,$min,$sec) = split(":",$time);
	    $time = $hour*3600+$min*60+$sec + $now-$daytime;
	    if( $mday != $nowday ) { $time -= 24*3600; }
	}
    }
    return( $time, $line, $4 );
}

1;
