in cmd/auparse/auparse.go [72:116]
func processLogs() error {
input, err := input()
if err != nil {
return err
}
defer input.Close()
output, err := output()
if err != nil {
return err
}
defer output.Close()
reassembler, err := libaudit.NewReassembler(5, 2*time.Second, &streamHandler{output})
if err != nil {
return fmt.Errorf("failed to create reassmbler: %w", err)
}
defer reassembler.Close()
// Start goroutine to periodically purge timed-out events.
go func() {
t := time.NewTicker(500 * time.Millisecond)
defer t.Stop()
for range t.C {
if reassembler.Maintain() != nil {
return
}
}
}()
// Process lines from the input.
s := bufio.NewScanner(input)
for s.Scan() {
line := s.Text()
auditMsg, err := auparse.ParseLogLine(line)
if err != nil {
log.Printf("failed to parse message header: %v", err)
}
reassembler.PushMessage(auditMsg)
}
return nil
}