<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000066">
<font color="#000000">Somewhere in between bug and misunderstanding.
The bug would be in documentation, but the behavior is deliberate.<br>
The reason is that when sending over the network to a syslog
server, the server expects the message in a certain format. When
you change the timestamp, that format is now invalid and the
remote end might not be able to parse it.<br>
<br>
Now you could put `ts_format(iso)` in the `tcp()` destination
driver. But if your remote server is looking for a timestamp in
ISO format, it probably supports the <a
href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1-guide-admin-en.html/concepts_message_ietfsyslog.html">syslog
message protocol</a>, which uses ISO timestamps. Syslog-ng uses
the <a
href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1-guide-admin-en.html/reference_destination_syslog.html">syslog</a>
destination driver for sending in this format.<br>
<br>
The syslog message protocol looks like this:<br>
</font><font color="#000000"><tt><font color="#660000"><34>1
2003-10-11T22:14:15.003Z mymachine.example.com su - ID47 -
BOM'su root' failed for lonvick on /dev/pts/8</font></tt></font><font
color="#000000"><br>
<br>
<br>
The forementioned bug in the documentation is that it says the
tcp() destination driver ts_format uses the global ts_format
setting. It doesnt.<br>
<br>
-Patrick<br>
<br>
<br>
<br>
Sent: Thu Apr 05 2012 21:31:54 GMT-0400 (EDT)<br>
From: Chris Hiestand <a class="moz-txt-link-rfc2396E" href="mailto:chiestand@salk.edu"><chiestand@salk.edu></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] ts_format(iso) bug or misunderstanding?</font>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<blockquote cite="mid:6CC6AC37-FFF4-44DE-9784-4155A2255DF2@salk.edu"
type="cite">
<pre wrap=""><font color="#000000">So I'm using iso timezone format for my syslog clients: options { … ts_format(iso); … };
I expected this to use the iso format for all syslog entries. However, I've found that it only uses
iso format for local syslog entries. syslog entries sent to the syslog-ng collector are in old rfc3164
format.
</font></pre>
<blockquote type="cite">
<pre wrap=""><font color="#000000">chiestand@host:~$ logger -t my-test asdlfkjasdfasdf
</font></pre>
</blockquote>
<pre wrap=""><font color="#000000">
which sends (3 local entries, 1 remote entry):
</font></pre>
<blockquote type="cite">
<pre wrap=""><font color="#000000">sudo strace -ff -p 13658
...
write(10, "2012-04-05T18:14:37-07:00 host "..., 64) = 64
write(11, "2012-04-05T18:14:37-07:00 host "..., 64) = 64
write(9, "<13>Apr 5 18:25:09 host my-test"..., 58) = 58
write(14, "2012-04-05T18:14:37-07:00 host "..., 64) = 64
</font></pre>
</blockquote>
<pre wrap=""><font color="#000000">
or viewing with tcpdump:
</font></pre>
<blockquote type="cite">
<pre wrap=""><font color="#000000">chiestand@host:/var/log$ sudo tcpdump -A host syslog.server.salk.edu
…
.va<13>Apr 5 18:20:31 host my-test: asdlfkjasdfasdf
</font></pre>
</blockquote>
<pre wrap=""><font color="#000000">
I would expect the iso format to be sent to the syslog-ng collector as well. Is this a bug or expected
behavior? I checked bugzilla and debian bug tracker and didn't see anything.
I'm running syslog-ng v3.1 on Debian squeeze.
Thanks,
Chris=</font></pre>
<font color="#000000"><br>
</font>
<fieldset class="mimeAttachmentHeader"></fieldset>
<font color="#000000"><br>
</font>
<pre wrap=""><font color="#000000">______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</font></pre>
</blockquote>
</body>
</html>