in auparse/auparse.go [218:258]
func parseAuditHeader(line string) (time.Time, uint32, int, error) {
// Find tokens.
start := strings.IndexRune(line, '(')
if start == -1 {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
dot := strings.IndexRune(line[start:], '.')
if dot == -1 {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
dot += start
sep := strings.IndexRune(line[dot:], ':')
if sep == -1 {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
sep += dot
end := strings.IndexRune(line[sep:], ')')
if end == -1 {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
end += sep
// Parse timestamp.
sec, err := strconv.ParseInt(line[start+1:dot], 10, 64)
if err != nil {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
msec, err := strconv.ParseInt(line[dot+1:sep], 10, 64)
if err != nil {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
tm := time.Unix(sec, msec*int64(time.Millisecond)).UTC()
// Parse sequence.
sequence, err := strconv.ParseUint(line[sep+1:end], 10, 32)
if err != nil {
return time.Time{}, 0, 0, errInvalidAuditHeader
}
return tm, uint32(sequence), end, nil
}