add parser-specific docs & rewrite sudo parser for journald

diff --git a/logparse/parsers/sshd_journald.py b/logparse/parsers/sshd_journald.py
index 841d195384a27e1f11424742d024d2fe64c8de47..e2a9e450dd9b3c339aac0bdace0213a7f50ba2a1 100644 (file)
--- a/logparse/parsers/sshd_journald.py
+++ b/logparse/parsers/sshd_journald.py
@@ -7,10 +7,10 @@
 import re
 from systemd import journal
 
-from logparse.formatting import *
-from logparse.util import resolve
 from logparse import config
+from logparse.formatting import *
 from logparse.load_parsers import Parser
+from logparse.util import resole
 
 class SshdJournald(Parser):
 
@@ -25,9 +25,10 @@ class SshdJournald(Parser):
         section = Section("ssh")
 
         j = journal.Reader()
-        j.this_boot()
-        j.log_level(journal.LOG_DEBUG)
+        j.this_machine()
+        j.log_level(journal.LOG_INFO)
         j.add_match(_COMM="sshd")
+        j.seek_realtime(section.period.startdate)
         
         messages = [entry["MESSAGE"] for entry in j if "MESSAGE" in entry]