perl的Parse::Syslog模块

my $parser = Parse ::Syslog -> new ( '/var/log/syslog' , year => 2001 );
while ( my $sl = $parser -> next ) {
              ...
            access $sl -> {timestamp |host |progra m |pid|text }
              ...
}
DESCRIPTION:描述

Unix syslogs are convenient to read for humans but because of small differences between operating systems and things like 'last message repeated xx times' not very easy to parse by a script.
UNIX系统日志很方便人去读但是由于操作系统等之间的细微差别像‘最后的消息重叠xx次’不是很容易用脚本去分析的。

Parse::Syslog presents a simple interface to parse syslog files: you create a parser on a file (withnew) and call next to get one line at a time with Unix-timestamp, host, program, pid and text returned in a hash-reference.
Parse::Syslog提供一个简单接口去分析系统日志文件：用new方式创建对文件分析的句柄然后调用next一次获取一行带时间戳、主机、程序、PID和文本信息到hash中。

Constructing a Parse：构建一个Parse

new:
   requires as first argument a source from where to get the syslog lines. It can be:
  a file-name for the syslog-file to be parsed.
  an IO::Handle object.
  a File::Tail object as first argument, in which case the read method will be called to get lines to process.
After the file-name (or File::Tail object), you can specify options as a hash. The following options are defined:
new需要一个参数来获取syslog的 它可以是：
    一个syslog文件的文件名
    一个I/O::目标句柄
    一个File::Tail木匾作为第一个参数，在这种情况下read方式会被调用来为程序获得行数据，
在文件名之后你可以指定目标左右一个hash，接着的选项是被定义的。

type:
    系统邮件或者其他log文件。

year:
syslog files usually do store the time of the event without year. With this option you can specify the start-year of this log. If not specified, it will be set to the current year.
系统日志记录时间时候通常不会记哪年，你可以通过这个选项指定log开始的年份，如果没有指定默认是当前的年份。 

GMT:
If this option is set, the time in the syslog will be converted assuming it is GMT time instead of local time.
如果设置该选项，系统日志的时间将被转换为GMT时间而不是当地时间。

repeat:
Parse::Syslog will by default repeat xx times events that are followed by messages like 'last message repeated xx times'. If you set this option to false, it won't do that.
Parse::Syslog会重复几次追踪事件消息像“最后消息重复几次”，如果不设，不会重复

arrayref:
If this option is true, next will return an array-ref instead of a hash-ref (and is thus a bit faster), with the following contents:0:timestamp 1:host 2:program 3:pid 4:text
如果该选项为真，next将返回数组引用代替哈希引用（会提高速度）：0：时间戳 1：主机 2：程序 3：pid 4：文本

locale:
Optional. Specifies an additional locale name or the array of locale names for the parsing of log files with national characters.
为解析log文件指定一个带有标志性的本地名字或者一组本地名字

allow_future:
If true will allow for timestamps in the future. Otherwise timestamps of one day in the future and more will not be returned (as a safety measure against wrong configurations, bogus --year arguments, etc.)允许在将来返回时间戳，否则不会返回。

Parsing the file:
The file is parse one line at a time by calling the next method, which returns a hash-reference containing the following keys:
timestamp:Unix timestamp for the event
时间戳：事件发生的UNIX事件
host:Host-name where the event did happen
主机：事件发生的主机位置
program:Program-name of the program that generated the event
程序：引起事件发生的程序名
pid:PID of the Program that generated the event. This information is not always available for every operating system
pid：长生事件的程序PID，对于不同的系统来说这个信息不总是可用的
text:Text description of the event.
文本：描述事件
msgid:Message numeric identifier, available only on Solaris >= 8 with "message ID generation" enabled".
msgid:消息标识符
facility:Log facility name, available only on Solaris >= 8 with "message ID generation" enabled".
设备：日至设备名
level:Log level, available only on Solaris >= 8 with "message ID generation" enabled".
等级：日志等级