Decode a syslog priority value

Challenge

Your job

int syslog_severity(const char *line);

A syslog line begins with <PRI> where PRI = facility×8 + severity (0–191). Return the severity (PRI % 8, 0–7), or -1 if the line doesn't start with <, has no digits, has no closing >, has more than 3 digits, or PRI > 191.

Hints

1. After <, read up to 3 digits, then require >.
2. severity = PRI % 8.

Why this matters

Every syslog line starts with <PRI>; severity = PRI mod 8. Triage pipelines read it constantly.

Starter code

int syslog_severity(const char *line) {
    /* TODO */
    (void)line;
    return -1;
}

Common mistakes

Forgetting the closing '>'. Allowing PRI > 191. Not capping digit count.

Edge cases to handle

PRI 0 and 191 (the extremes). Missing bracket. Overlong number.

Complexity

O(1).

Background lessons

• Detect failed-login bursts in auth.log

Up next

• Validate JWT structure