yes,I really think that solves the problem£¬and this feature is very useful, especially in large sites across time zones to <span class="trans">centralize</span> collect log.I really hope you will be able to in the old and new versions are added to this option,deeply thanks.<br>
<br><div class="gmail_quote">2009/2/15 Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Thu, 2009-02-12 at 09:52 +0800, Charles Chan wrote:<br>
> I use time_zone instead timezone,configuration like this<br>
> ===========================================================<br>
> template apache_template { template("$DAY-$HOUR $S_DAY-$S_HOUR<br>
> $R_DAY-$R_HOUR $MSGONLY\n"); template_escape(no); };<br>
> destination us_int_apache<br>
> { file("/disk2/apache_logs/$YEAR-$MONTH-$DAY/$HOST.apache.log"<br>
> timezone("PST8PDT") template(apache_template)); };<br>
> ============================================================<br>
> service can start,but the problem still exists.<br>
> the file is stored in the /disk2/apache_logs/2009-02-12<br>
> generated log is:<br>
> 11-17 11-17 11-17 222.69.201.23 - - - [11/Feb/2009:17:37:03 -0800]<br>
> "GET /atmgateway.client.html ...................<br>
> two date string still difference. I use syslog-ng 3.0.1 OSE version,is<br>
> this OSE version problem?<br>
<br>
</div>The PE and OSE versions are the same in this regard. Apart from the<br>
concrete differences listed on our website, I work hard to keep the two<br>
versions in sync.<br>
<br>
So let me try to understand your problem a bit deeper... Sorry for not<br>
having done so previously. Sometimes I just reply without really<br>
thinking through problems in the question.<br>
<br>
hmm.. as I see your problem seems to be that the name of the file and<br>
the _content_ of the file contains a different timestamp. Right?<br>
<br>
This is intentional.<br>
<br>
When expanding the macros in the name of the files, syslog-ng _always_<br>
uses the server-side, local timezone. The timezone used in the content<br>
of the file can be controlled using the time_zone() option.<br>
<br>
Currently there's no way to control the filename zone offset. The<br>
reasoning behind that was that I already found the timezone related<br>
configuration options too complex, and I didn't see the need so far.<br>
I felt that agregating logs based on the _received timestamp_ is more<br>
trustworthy (because clients are free to specify a timestamp they<br>
feel-like), and that is in local timezone anyway. Also, noone else has<br>
complained previously :)<br>
<br>
That said, I'm willing to add another option to control the timezone<br>
used when expanding the filename, if you really think that solves your<br>
problem.<br>
<font color="#888888"><br>
<br>
--<br>
</font><div><div></div><div class="Wj3C7c">Bazsi<br>
<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</div></div></blockquote></div><br>