<div>Okay, I tried it out and it works. Here's my configuration:<br>
<br>
#
local0.debug
/var/log/ngr/ngr_3456_A.log<br>
<br>
filter f_12 {<br>
facility(local0) and level(debug..emerg);<br>
};<br>
<br>
destination d_8 {<br>
file("/var/log/ngr/ngr_3456_A_$MONTH$DAY$YEAR.log"<br>
ts_format("iso")<br>
template("$R_ISODATE $HOST $MSG\n")<br>
template_escape(no)<br>
create_dirs(yes)<br>
frac_digits(3)<br>
);<br>
};<br>
<br>
log { source(local); filter(f_12); destination(d_8); };<br>
<br>
This gives me the following output: 2006-02-13T08:52:54.554+05:00 localhost <rest of message><br>
<br>
So, in other words, I just added the frac_digits() option to file().<br>
<br>
Thanks for helping me out - I appreciate it.<br>
<br>
Rodney<br>
<br><div><font color="#990099">-----syslog-ng-bounces@lists.balabit.hu wrote: -----<br><br></font><blockquote style="border-left: 2px solid rgb(0, 0, 0); padding-right: 0px; padding-left: 5px; margin-left: 5px; margin-right: 0px;">To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>From: Balazs Scheidler <bazsi@balabit.hu><br>Sent by: syslog-ng-bounces@lists.balabit.hu<br>Date: 02/12/2006 08:41AM<br>Subject: Re: [syslog-ng] RFC3339 fractional second logging<br><br><font face="monospace" size="3">On Sun, 2006-02-12 at 11:44 +0100, Balazs Scheidler wrote:<br>> On Sun, 2006-02-12 at 11:37 +0100, Balazs Scheidler wrote:<br>> > On Fri, 2006-02-10 at 08:29 -0500, rlott@ivhs.com wrote:<br><br>> So there are two timestamps per message:<br>> <br>> 1) the one in the message as received from the peer, it will never<br>> contain fractions except when the message was generated by syslog-ng and<br>> this information was also sent by using a custom template (syslog-ng<br>> tries to remain compatible with existing syslog devices by default, thus<br>> it does not send an extended timestamp) Macros referencing this timestamp <br>> begin with "S_" (for stamp)<br>> <br>> 2) the one assigned by syslog-ng when the message was received from the<br>> peer. This should always contain fractions. These stamps begin with<br>> "R_" (for received)<br>> <br>> The prefixes might not be very intuitive, their naming is historical<br>> heritage :)<br>> <br>> Thus the example configuration that you sent above should indeed include<br>> the time fractions, but not because the peer sends it, but because<br>> syslog-ng generates R_ timestamps locally as the messages arrive.<br>> <br>> However it does not work for some reason. Let me check it and get back<br>> to you.<br>> <br><br>I've just committed a patchset that should fix this functionality. I<br>also added frac_digits() option which controls how precisely time<br>fractions should be represented. (again, you need tomorrow's snapshot)<br><br>This is my test configuration:<br><br>options { <br><span> </span> file_template(t_file); <br><span> </span> proto_template(t_proto); <br><span> </span> ts_format(iso); <br><span> </span> normalize_hostnames(yes); <br>};<br><br>template t_file { template("<$PRI>$ISODATE $HOST $MSG\n"); template-escape(no); };<br>template t_proto { template("<$PRI>$ISODATE $HOST $MSG\n"); template-escape(no); };<br><br>source s_udp { unix-stream("log"); udp(ip("0.0.0.0") port(2000) flags(kernel) keep-timestamp(no)); };<br><br>destination d_file {<br> file("/home/bazsi/zwa/install/syslog-ng-2.0/logs/messages");<br> udp("localhost" port(3000) frac_digits(6));<br>};<br><br>log { source(s_udp); destination(d_file); };<br><br><br>-- <br>Bazsi<br><br>_______________________________________________<br>syslog-ng maillist - syslog-ng@lists.balabit.hu<br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></font></blockquote><br></div></div>