<div dir="ltr"><div><div><div><div>Hi,<br><br></div>I am basically done with cleaning up the stuff. You can find my latest version at <a href="https://github.com/balabit/syslog-ng/tree/f/date-parser">https://github.com/balabit/syslog-ng/tree/f/date-parser</a><br><br></div>I still have to clean up the branch, it is currently just a dump of patches, but the final state should be pretty close that I'd try to push for integration.<br><br></div>There's one issue that is still open: strptime() at least as implemented in various libc versions is unusable, so we should probably roll our own implementation. Reasons:<br><br></div><div>1) tm_gmtoff is not portable<br></div><div>2) %z as a parsing format is not portable<br></div><div>3) %z doesn't accept ISO8601 standard zone offsets when there's a colon between hours and minutes<br><br></div><div>Also, it can be affected by locale settings (which is not good for the syslog-ng case) and is probably very slow. (at one point syslog-ng used strptime for normal log traffic and I remember replacing it with hand-coded routines increased performance a lot). I'll try to get an strptime implementation from somewhere and tailor it to our needs.<br><br><br></div><div>Any feedback is appreciated.<br></div><div>Bazsi<br><br></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">-- <br>Bazsi<br></div></div></div>
<br><div class="gmail_quote">On Sun, Oct 25, 2015 at 4:44 PM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Hi,<br><br></div>As I see you assume a date is from UTC if there's no timezone information. I would think that using the local timezone is more intuitive in this case:<br><br> testcase("Tue, 27 Jan 2015 11:48:46", NULL, "%a, %d %b %Y %T", "2015-01-27T11:48:46+00:00");<br><br></div>What do you think?<span class="HOEnZb"><font color="#888888"><br><br></font></span></div><div class="gmail_extra"><span class="HOEnZb"><font color="#888888"><br clear="all"><div><div><div dir="ltr">-- <br>Bazsi<br></div></div></div></font></span><div><div class="h5">
<br><div class="gmail_quote">On Sun, Oct 25, 2015 at 12:36 PM, Scheidler, Balázs <span dir="ltr"><<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">thanks for the quick reply.<span><font color="#888888"><br><br></font></span></div><div class="gmail_extra"><span><font color="#888888"><br clear="all"><div><div><div dir="ltr">-- <br>Bazsi<br></div></div></div></font></span><div><div>
<br><div class="gmail_quote">On Sun, Oct 25, 2015 at 12:35 PM, Vincent Bernat <span dir="ltr"><<a href="mailto:vincent@bernat.im" target="_blank">vincent@bernat.im</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> ❦ 25 octobre 2015 12:32 +0100, "Scheidler, Balázs" <<a href="mailto:balazs.scheidler@balabit.com" target="_blank">balazs.scheidler@balabit.com</a>> :<br>
<span><br>
> I'd have a question though: I can see the date-offset() option for<br>
> date parser, which seems to skip the specified number of characters in<br>
> the input.<br>
><br>
> Can you please describe the usecase behind that? I'd be reluctant to<br>
> add such an option to a parser (as none of the other have such an<br>
> option), and it should be possible to do the same using template<br>
> functions, e.g. something like this:<br>
><br>
> date-parser(template("$(substr $MSG 5)"));<br>
><br>
> This would similarly skip the first 5 characters.<br>
><br>
> If this addresses your original use-case, I'd drop the date-offset()<br>
> option.<br>
<br>
</span>Yes, this would cover my use case.<br>
<span><font color="#888888">--<br>
Use library functions.<br>
- The Elements of Programming Style (Kernighan & Plauger)<br>
</font></span></blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div>