I use follow configuration still not work,display "syntax error".<br>destination us_int_apache { file("/disk2/apache_logs/$YEAR-$MONTH-$DAY/$HOST.apache.log" timezone("PST8PDT") template(apache_template)); };<br>
<br>syslog-ng version as follows:<br>[root@wikid ~]# /opt/syslog-ng/sbin/syslog-ng -V<br>syslog-ng 3.0.1<br>Revision: <br>Compile-Date: Feb 9 2009 09:58:34<br>Enable-Threads: off<br>Enable-Debug: off<br>Enable-GProf: off<br>
Enable-Memtrace: off<br>Enable-Sun-STREAMS: off<br>Enable-Sun-Door: off<br>Enable-IPv6: on<br>Enable-Spoof-Source: off<br>Enable-TCP-Wrapper: on<br>Enable-SSL: on<br>Enable-SQL: off<br>Enable-Linux-Caps: on<br>Enable-Pcre: off<br>
<br><div class="gmail_quote">2009/2/10 Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Tue, 2009-02-10 at 11:47 +0800, Charles Chan wrote:<br>
> We update syslog-ng to 3.0.1,configuration same with 2.1,but the<br>
> problem still exists,In 3.0 just have two parameter about<br>
> timezone("time_zone" and "timezone"),not find specify a location by<br>
> name instead of using plain timezone offsets which do not support<br>
> day-light-saving as you say.The Doc not include "timezone" parameter<br>
> deail example£¬ Can you help me fix the problem and give me some<br>
> config examples?<br>
<br>
</div>When using timezone() in 3.0, you can reference the name of the<br>
timezone, e.g.<br>
<br>
timezone("Europe/Budapest");<br>
<br>
The name of the timezone can either be a direct timezone offset<br>
reference as earlier (e.g. +01:00), or the name of a timezone info file<br>
under /usr/share/zoneinfo.<br>
<br>
I'm Ccing the documentation team, to clarify the documentation about<br>
this.<br>
<div><div></div><div class="Wj3C7c"><br>
><br>
> 2009/1/17 Balazs Scheidler <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>><br>
><br>
> On Thu, 2009-01-15 at 15:03 +0800, Charles Chan wrote:<br>
> > Recently I use the syslog-ng for log collection environment<br>
> > encountered a time zone problem,hope somebody can help<br>
> me.Thanks<br>
> > The environment is like this:<br>
> > The apache server(PDT timezone,UTC-8) forword apache log<br>
> through<br>
> > syslog to the syslog-ng server£¨CST timezone£¬UTC£«8£©.<br>
> > The server with same time zones no problem between the<br>
> forward.<br>
> > Syslog-ng test configuration is as follows:<br>
> > destination int_apache (file ( "/ disk3/cookie_logs/pid1 / $<br>
> YEAR-$<br>
> > MONTH-$ DAY / $ (HOST). apache.log" time_zone (-08:00)<br>
> template ( "$<br>
> > DAY-$ HOUR $ S_DAY-$ S_HOUR $ R_DAY-$ R_HOUR $ $ ISODATE $<br>
> MSGONLY \ n<br>
> > ") template_escape (no)););<br>
> ><br>
> > The original apache log is:<br>
> > 58.240.69.161 - - - [14/Jan/2009: 22:27:47 -0800] "GET /<br>
> > <a href="http://www.example.com/" target="_blank">www.example.com/</a> HTTP/1.1" 200 2028 "-" "Mozilla/4.0<br>
> ( compatible;<br>
> > MSIE 7.0; Windows NT 5.1) "<br>
> ><br>
> > The syslog-ng server generated log is:<br>
> > 14-22 14-22 14-22 2009-01-14T22 :27:47-08: 00 58.240.69.161<br>
> - - -<br>
> > [14/Jan/2009: 22:27:47 -0800] "GET / www.example. com /<br>
> HTTP/1.1 "200<br>
> > 2028" - "" Mozilla/4.0 (compatible; MSIE 7.0; Windows NT<br>
> 5.1) "<br>
> ><br>
> > Originally generated documents should be kept in<br>
> > /disk3/cookie_logs/pid1/2009-01-14<br>
> > However, the actual file is stored in the<br>
> > /disk3/cookie_logs/pid1/2009-01-15<br>
> > It can be seen, in fact, syslog-ng configuration item file()<br>
> use the<br>
> > $DAY and template() use the $DAY not with a identical<br>
> Macros. Is this<br>
> > the syslog-ng a bug? or I configuration errors. Who can help<br>
> me answer<br>
> > you?Thanks!<br>
><br>
><br>
> Well, as I researched this area, there's some version<br>
> dependance here.<br>
> In syslog-ng 2.1 (and probably 2.0, but I haven't checked) if<br>
> you use<br>
> the time related macros in a filename, then the timestamps are<br>
> converted<br>
> to use the local timezone of the syslog-ng process. In the<br>
> examples<br>
> above, the time_zone() option only affects the _contents_ of<br>
> the file,<br>
> and not the filenames.<br>
><br>
> In 3.0 this "behaviour" is fixed and the timezone of the<br>
> timestamp is<br>
> used, without alteration.<br>
><br>
> (and NOTE that in 3.0 the timezone handling was expanded<br>
> significantly,<br>
> e.g. you can specify a location _by name_ instead of using<br>
> plain<br>
> timezone offsets which do not support day-light-saving)<br>
><br>
> --<br>
> Bazsi<br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info:<br>
> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation:<br>
> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
><br>
</div></div>--<br>
<div><div></div><div class="Wj3C7c">Bazsi<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</div></div></blockquote></div><br>