systemd_journal.py 文件源码

def parse_journal(data):
    """"
    Parse systemd journal entries.

    We do this on the agent rather than the manager because:
     * It allows us to distribute this bit of load
     * It localizes the means of log acquisition entirely to the agent,
       the manager never has any idea that the journal is in use or what
       forwarding protocol is being used.
    """

    utc_dt = get_localzone().localize(data['__REALTIME_TIMESTAMP'], is_dst=None).astimezone(pytz.utc)

    return {
        'datetime': datetime.datetime.isoformat(utc_dt),
        'severity': data['PRIORITY'],
        'facility': data['SYSLOG_FACILITY'],
        'source': data.get('SYSLOG_IDENTIFIER', "unknown"),
        'message': data['MESSAGE']
    }