Skip to content

in_syslog: initialize parser timestamps for stream records - #12447

Merged
edsiper merged 2 commits into
masterfrom
fix/syslog-parser-time
Sep 20, 2026
Merged

edsiper merged 2 commits into
masterfrom
fix/syslog-parser-time

Conversation

@edsiper

@edsiper edsiper commented Sep 19, 2026 •

Copy link
Copy Markdown
Member

Clear the output timestamp before parsing each stream record. Parsers without a configured time key can leave that value untouched, causing uninitialized reads and invalid record timestamps.

Validation: The baseline triggered Valgrind uninitialized-value errors. The JSON-parser regression passed normally and under strict Valgrind after the fix. Existing syslog TCP, TLS, UDP and Unix socket scenarios passed normally and under strict Valgrind.

Focused integration commands (run against the combined validation build containing these fixes):

FLUENT_BIT_BINARY=$PWD/build/bin/fluent-bit tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/syslog_parser_time -q
VALGRIND=1 VALGRIND_STRICT=1 FLUENT_BIT_BINARY=$PWD/build/bin/fluent-bit tests/integration/.venv/bin/python -m pytest tests/integration/scenarios/syslog_parser_time -q

Full PR-range commit-prefix lint, DCO and whitespace checks passed against fetched master. Code and regression tests are separate commits.

Compatibility: Records without a parsed timestamp use the existing current-time fallback. Parsed timestamps and configuration interfaces are unchanged.

Summary by CodeRabbit

  • Bug Fixes

    • Improved syslog timestamp handling when incoming messages do not include a timestamp.
    • Ensured fallback timestamp processing uses a consistent, defined value and improves parser reliability.
  • Tests

    • Added integration coverage across supported input modes to verify syslog parser behavior, message recovery, and continued process stability.

Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
@coderabbitai

coderabbitai Bot commented Sep 19, 2026 •

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 4adea32a-ffa8-4a59-9d8e-aef6ba779989

📥 Commits

Reviewing files that changed from the base of the PR and between a48daa6 and a5e06c4.

📒 Files selected for processing (2)
  • plugins/in_syslog/syslog_prot.c
  • tests/integration/scenarios/syslog_parser_time/tests/test_syslog_parser_time.py

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.


📝 Walkthrough

Walkthrough

The syslog parser now zero-initializes its output timestamp before parsing. A new integration test starts Fluent Bit, sends timestamp-free JSON messages through syslog input, and verifies both messages are processed while the daemon remains running.

Changes

Syslog timestamp handling

Layer / File(s) Summary
Initialize parser output timestamp
plugins/in_syslog/syslog_prot.c
syslog_prot_process resets out_time before it invokes the parser.
Validate timestamp-free parser input
tests/integration/scenarios/syslog_parser_time/tests/test_syslog_parser_time.py
The integration test manages a Fluent Bit daemon, sends before and after marker messages through syslog input, and verifies both markers appear while the process remains active. Valgrind execution is supported through the test setup.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 2 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: initializing parser timestamps for syslog stream records.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 19, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-19T15:32:19.129282Z a5e06c4 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a5e06c4168

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

address = str(tmp_path / "input.sock") if plugin == "unix_socket" else ("127.0.0.1", port)
parser = tmp_path / "parsers.conf"
parser.write_text("[PARSER]\n Name json\n Format json\n")
command = [os.environ["FLUENT_BIT_BINARY"], "-f", "0.1", "-R", str(parser), "-i", plugin]

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Honor the suite's default binary lookup

When this scenario is run through the documented default ./run_tests.py flow without setting FLUENT_BIT_BINARY, this direct environment lookup raises KeyError before Fluent Bit starts, even when build/bin/fluent-bit exists. Use the suite's binary resolver/manager or provide the same default-path fallback used elsewhere.

AGENTS.md reference: AGENTS.md:L62-L65

Useful? React with 👍 / 👎.

command += ["-o", "stdout", "-m", "*", "-p", "format=json_lines"]
log = tmp_path / "fluent-bit.log"
memlog = tmp_path / "valgrind.log"
memory = os.environ.get("VALGRIND") == "1"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Run the test under the selected macOS memory checker

On macOS, invoking the required memory-safety pass with LEAKS=1 LEAKS_STRICT=1 leaves memory false because this custom launcher only recognizes VALGRIND; the test consequently runs Fluent Bit directly and can report success without checking leaks. Handle the Leaks mode or use the shared process manager that supports both platform checkers.

AGENTS.md reference: AGENTS.md:L101-L105

Useful? React with 👍 / 👎.

@edsiper
edsiper merged commit b8bf3b0 into master Sep 20, 2026
60 of 62 checks passed
@edsiper
edsiper deleted the fix/syslog-parser-time branch September 20, 2026 15:58

This branch was successfully deployed

1 active deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant