create new logcheck patterns for rsyslog with high-precision timestamps

create-logcheck-patterns-hires.pl

#!/usr/bin/env perl

use strict;
use warnings;
use FileHandle;
use File::Basename;

# find configured report level
my $reportLevel = 'server';
my $configFh = FileHandle->new('/etc/logcheck/logcheck.conf', 'r');
while (<$configFh>) {
  next if (m/^\s*#/);
  if (m/REPORTLEVEL\s*=\s*"?([^"]+)"?/) {
    $reportLevel = $1;
    last;
  }
}

# find all pattern files with old timestamp pattern '^\w{3}':
my @files = `egrep -rl '^\\^\\\\w\\{3\\}' /etc/logcheck`;

# for all files create a new file named hirestime-$filename
# with replaced pattern
foreach my $orig (@files) {
  chomp $orig;

  my $fh = FileHandle->new($orig, 'r');
  my ($filename, $dirname) = fileparse($orig);
  $dirname =~ s/\/$//;
  my $newfilename = sprintf('%s/hirestime-%s', $dirname, $filename);
  my $out = FileHandle->new($newfilename, 'w');

  while (<$fh>) {
    next unless m/^\^\\w\{3\} \[ :(0-9|\[:digit:\])\]\{11\} /;
    s/^\^\\w\{3\} \[ :(0-9|\[:digit:\])\]\{11\} /^[0-9-]{10}T[0-9:]{8}(\\.[0-9]+)?\\+[0-9:]{5} /g;
    print $out $_;
  }
  undef $fh;
  undef $out;
   
  if ($dirname eq "/etc/logcheck/ignore.d.${reportLevel}") {
    printf("Linking %s to violations.ignore.d\n", $newfilename);
    system "ln -nfs $newfilename /etc/logcheck/violations.ignore.d/hirestime-$filename";
  }
}

this does a little too much, it creates links in /etc/logcheck/violations.ignore.d for all newly created files, while you probably only want the ones from the directory corresponding with your REPORTLEVEL.

new version only links files from the directory for the configured reportlevel.