create new logcheck patterns for rsyslog with high-precision timestamps

create-logcheck-patterns-hires.pl

#!/usr/bin/env perl

use strict;
use warnings;
use FileHandle;
use File::Basename;

# find configured report level
my $reportLevel = 'server';
my $configFh = FileHandle->new('/etc/logcheck/logcheck.conf', 'r');
while (<$configFh>) {
  next if (m/^\s*#/);
  if (m/REPORTLEVEL\s*=\s*"?([^"]+)"?/) {
    $reportLevel = $1;
    last;
  }
}

# find all pattern files with old timestamp pattern '^\w{3}':
my @files = `egrep -rl '^\\^\\\\w\\{3\\}' /etc/logcheck`;

# for all files create a new file named hirestime-$filename
# with replaced pattern
foreach my $orig (@files) {
  chomp $orig;

  my $fh = FileHandle->new($orig, 'r');
  my ($filename, $dirname) = fileparse($orig);
  $dirname =~ s/\/$//;
  my $newfilename = sprintf('%s/hirestime-%s', $dirname, $filename);
  my $out = FileHandle->new($newfilename, 'w');

  while (<$fh>) {
    next unless m/^\^\\w\{3\} \[ :(0-9|\[:digit:\])\]\{11\} /;
    s/^\^\\w\{3\} \[ :(0-9|\[:digit:\])\]\{11\} /^[0-9-]{10}T[0-9:]{8}(\\.[0-9]+)?\\+[0-9:]{5} /g;
    print $out $_;
  }
  undef $fh;
  undef $out;
   
  if ($dirname eq "/etc/logcheck/ignore.d.${reportLevel}") {
    printf("Linking %s to violations.ignore.d\n", $newfilename);
    system "ln -nfs $newfilename /etc/logcheck/violations.ignore.d/hirestime-$filename";
  }
}

new version only links files from the directory for the configured reportlevel.