Module linux_syslog 

Linux kernel-log (syslog / dmesg) USB device reader.

The kernel logs each USB enumeration as a short block keyed by a bus id, e.g.

Mar 24 15:47:28 kernel: [ 2.350118] usb 2-1: New USB device found, idVendor=80ee, idProduct=0021, bcdDevice= 1.00
Mar 24 15:47:28 kernel: [ 2.350143] usb 2-1: Product: USB Tablet
Mar 24 15:47:28 kernel: [ 2.350146] usb 2-1: Manufacturer: VirtualBox
Mar 24 15:47:28 kernel: [ 2.350150] usb 2-1: SerialNumber: 0123ABCD

This reader stitches the block back into a DeviceConnection (bus, VID/PID, serial, friendly name, first-seen time). The syslog timestamp is year-less (a BSD-format forensic limitation) and host-local, so the caller supplies the reference year and the epoch is a naive-local conversion — the same caveat the setupapi reader carries.

Functions

parse_linux_syslog

Parse Linux kernel USB-enumeration blocks from syslog / dmesg text.