<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi John,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Can you try it with another source?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>source s_test {<br>
</span>
<div> network(transport(udp) port(9090));<br>
</div>
<span>};</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>...</span></span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><span>log { source(s_src); source(s_test); destination(d_net); };<br>
</span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Then run:</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>echo -n "test" >/dev/udp/localhost/9090<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>You can enable/disable wifi on your system, to generate kernel messages.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
To me the output looks like this:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><13>Sep 4 08:50:32.370 127.0.0.1 test<br>
</span>
<div><13>Sep 4 08:50:33.010 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:33.425 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:33.746 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:34.066 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:34.658 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:35.026 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:35.314 127.0.0.1 test<br>
</div>
<div><13>Sep 4 08:50:35.666 127.0.0.1 test<br>
</div>
<div><85>Sep 4 08:50:36.000 alltilla-Precision-5530 su[30952]: pam_unix(su:auth): authentication failure; logname=alltilla uid=1001 euid=0 tty=/dev/pts/11 ruser=alltilla rhost= user=root<br>
</div>
<div><83>Sep 4 08:50:38.000 alltilla-Precision-5530 su[30952]: pam_authenticate: Authentication failure</div>
<div>
<div><6>Sep 4 08:52:47.691 alltilla-Precision-5530 kernel: IPv6: ADDRCONF(NETDEV_UP): wlp59s0: link is not ready<br>
</div>
<div><6>Sep 4 08:52:47.775 alltilla-Precision-5530 kernel: IPv6: ADDRCONF(NETDEV_UP): wlp59s0: link is not ready<br>
</div>
<div><br>
</div>
<span></span></div>
<div>My su messages do not have sub-second times, either, but the test udp source, and wifi-generated kernel messages do have.</div>
<div>I am testing this on 3.5.6 on an Ubuntu-Xenial machine.</div>
<div><br>
</div>
<div>Although, there is some change about the frac-digits() behavior in 3.5.6, maybe 3.5.3 will have all zeros still.</div>
<div><a href="https://github.com/balabit/syslog-ng/commit/70d758fe40ad64f78e28e87b629c54fbd1fdc09e">https://github.com/balabit/syslog-ng/commit/70d758fe40ad64f78e28e87b629c54fbd1fdc09e</a></div>
<div><br>
</div>
<div>Thanks Szemere for the help!</div>
<div><br>
</div>
<div>Best regards,</div>
<div>Attila</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of John Chang <jchang@skytap.com><br>
<b>Sent:</b> Wednesday, September 4, 2019 1:18 AM<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] sub-second time digits all 0</font>
<div> </div>
</div>
<div>
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">Hello, I am not getting non-zero sub-second timestamp digits. My <span style="color:rgb(0,0,0); font-family:Menlo">/etc/syslog-ng/syslog-ng.conf file includes this global configuration:</span></div>
<div dir="ltr"><font color="#000000" face="Menlo"><span style="font-size:11px"><br>
</span></font></div>
<div dir="ltr">
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"># First, set some global options.</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">options { frac-digits(3); chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"> owner("root"); group("adm"); perm(0640); stats_freq(0);</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"> bad_hostname("^gconfd$");</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">};</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"><br>
</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"><br>
</span></p>
<p style="margin:0px; font-stretch:normal; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">My </span>syslog-ng.conf also includes a sub-config file for sending the logs to a remote host, with this configuration:</p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<br>
</p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<br>
</p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">destination d_net {</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"> udp("loggerhost" port(30515) frac-digits(3) );</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">};</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
</p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">log { source(s_src); destination(d_net); };</span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"><br>
</span></p>
<p style="margin:0px; font-stretch:normal; line-height:normal; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif"><br>
</font></span></p>
<p style="margin:0px; font-stretch:normal; line-height:normal; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif">But all sub-second timestamp digits wind up being only zeroes on the remote "loggerhost", like this:</font></span></p>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<br>
</p>
<span style="color:rgb(0,0,0); font-family:Menlo; font-size:11px"></span>
<div><br>
</div>
<div>
<p style="margin:0px; font-stretch:normal; font-size:11px; line-height:normal; font-family:Menlo; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures">2019-09-03T21:57:23.000+00:00 10.73.254.255 [info] [sshd] 3284 Accepted password for root from 10.72.0.186 port 50720 ssh2</span></p>
<p style="margin:0px; font-stretch:normal; line-height:normal; color:rgb(0,0,0)">
<span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif"><br>
</font></span></p>
<p style="margin:0px; font-stretch:normal; line-height:normal; color:rgb(0,0,0)">
<font face="arial, sans-serif">The sending host is running syslog-ng 3.5.3. The receiving "loggerhost" is running 3.5.6 Thanks in advance for any help you can afford.</font></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>