<div dir="ltr">Man, I knew that - sorry I missed it! (and normally, I do use the R_ macro, I just missed it in this user's example that was sent to me)<div><br><div>Thanks for the response :-)</div><div><br></div><div>
<br></div></div></div><div class="gmail_extra"><br clear="all"><div>______________________________________________________________ <br><br>Clayton Dukes<br>______________________________________________________________</div>
<br><br><div class="gmail_quote">On Fri, Dec 6, 2013 at 5:07 AM, Sandor Geller <span dir="ltr"><<a href="mailto:Sandor.Geller@morganstanley.com" target="_blank">Sandor.Geller@morganstanley.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Most likely the incoming log simply doesn't contain a high-res<br>
timestamp. You're using UNIXTIME (which is M_UNIXTIME unless<br>
keep_timestamp is set to no) so it is read from the log header.<br>
Instead of M_ macros you could use the timestamp when the message was<br>
received (R_ macros) or those which refer to the actual time when<br>
syslog-ng delivers a log (C_ macros).<br>
<div><div class="h5"><br>
On Fri, Dec 6, 2013 at 8:30 AM, Clayton Dukes <<a href="mailto:cdukes@gmail.com">cdukes@gmail.com</a>> wrote:<br>
> Hi,<br>
> I have a system configured to microseconds logging, but for most of entries<br>
> it's always zero - actually the only program which logs it correctly is the<br>
> syslog-ng itself.<br>
><br>
> @1386239689.000000 13 blah<br>
><br>
> @1386239859.947724 45 syslog-ng shutting down; version='3.5.2'<br>
><br>
> @1386239860.304194 45 syslog-ng starting up; version='3.5.2'<br>
><br>
> @1386239860.337325 45 EOF on control channel, closing connection;<br>
><br>
> @1386239865.000000 13 blah<br>
><br>
><br>
> Anyone have an idea what I'm doing wrong?<br>
><br>
><br>
> Here's the config:<br>
><br>
> destination d_mydest{<br>
><br>
> program("/somepath"<br>
><br>
> template("@${UNIXTIME:--}\t${PRI:--}\t${MSGONLY}\n")<br>
><br>
> flags(no_multi_line)<br>
><br>
> flush_timeout(100)<br>
><br>
> frac_digits(6)<br>
><br>
> );<br>
><br>
> };<br>
><br>
> ______________________________________________________________<br>
><br>
> Clayton Dukes<br>
> ______________________________________________________________<br>
><br>
</div></div>> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation:<br>
> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
</blockquote></div><br></div>