We update syslog-ng to 3.0.1,configuration same with 2.1,but the problem still exists,In 3.0 just have two <span class="trans">parameter </span>about timezone("time_zone" and "timezone"),not find specify a location by name instead of using plain timezone offsets which do not support day-light-saving as you say.The Doc not include "timezone" <span class="trans">parameter deail </span> example£¬ Can you help me fix the problem and give me some config examples?<br>
<br><div class="gmail_quote">2009/1/17 Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class="Wj3C7c">On Thu, 2009-01-15 at 15:03 +0800, Charles Chan wrote:<br>
> Recently I use the syslog-ng for log collection environment<br>
> encountered a time zone problem,hope somebody can help me.Thanks<br>
> The environment is like this:<br>
> The apache server(PDT timezone,UTC-8) forword apache log through<br>
> syslog to the syslog-ng server£¨CST timezone£¬UTC£«8£©.<br>
> The server with same time zones no problem between the forward.<br>
> Syslog-ng test configuration is as follows:<br>
> destination int_apache (file ( "/ disk3/cookie_logs/pid1 / $ YEAR-$<br>
> MONTH-$ DAY / $ (HOST). apache.log" time_zone (-08:00) template ( "$<br>
> DAY-$ HOUR $ S_DAY-$ S_HOUR $ R_DAY-$ R_HOUR $ $ ISODATE $ MSGONLY \ n<br>
> ") template_escape (no)););<br>
><br>
> The original apache log is:<br>
> 58.240.69.161 - - - [14/Jan/2009: 22:27:47 -0800] "GET /<br>
> <a href="http://www.example.com/" target="_blank">www.example.com/</a> HTTP/1.1" 200 2028 "-" "Mozilla/4.0 ( compatible;<br>
> MSIE 7.0; Windows NT 5.1) "<br>
><br>
> The syslog-ng server generated log is:<br>
> 14-22 14-22 14-22 2009-01-14T22 :27:47-08: 00 58.240.69.161 - - -<br>
> [14/Jan/2009: 22:27:47 -0800] "GET / www.example. com / HTTP/1.1 "200<br>
> 2028" - "" Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) "<br>
><br>
> Originally generated documents should be kept in<br>
> /disk3/cookie_logs/pid1/2009-01-14<br>
> However, the actual file is stored in the<br>
> /disk3/cookie_logs/pid1/2009-01-15<br>
> It can be seen, in fact, syslog-ng configuration item file() use the<br>
> $DAY and template() use the $DAY not with a identical Macros. Is this<br>
> the syslog-ng a bug? or I configuration errors. Who can help me answer<br>
> you?Thanks!<br>
<br>
</div></div>Well, as I researched this area, there's some version dependance here.<br>
In syslog-ng 2.1 (and probably 2.0, but I haven't checked) if you use<br>
the time related macros in a filename, then the timestamps are converted<br>
to use the local timezone of the syslog-ng process. In the examples<br>
above, the time_zone() option only affects the _contents_ of the file,<br>
and not the filenames.<br>
<br>
In 3.0 this "behaviour" is fixed and the timezone of the timestamp is<br>
used, without alteration.<br>
<br>
(and NOTE that in 3.0 the timezone handling was expanded significantly,<br>
e.g. you can specify a location _by name_ instead of using plain<br>
timezone offsets which do not support day-light-saving)<br>
<font color="#888888"><br>
--<br>
Bazsi<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</font></blockquote></div><br>