<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Hi John,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
It seems like, that su and sshd do not provide sub-second timestamp. There cannot be a fix for that from syslog-ng side.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
You can choose to discard the timestamps provided by the source, and use the timestamp for the log reception. The 'reception' timestamp has sub-second time information.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Note, that the 'reception' timestamp can differ from the original timestamp.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<a href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.22/administration-guide/keep-timestamp" id="LPlnk706512" data-ogsc="" style="">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.22/administration-guide/keep-timestamp</a><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
May I ask you, if there is any particular reason, you are using 3.5.3? There are fresher releases, with a lot of new features and bugfixes.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Best regards,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Attila</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;" data-ogsc=""><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of John Chang <jchang@skytap.com><br>
<b>Sent:</b> Wednesday, September 4, 2019 11:17 PM<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] sub-second time digits all 0</font>
<div> </div>
</div>
<div>
<div style="width: 100%; border-style: solid; border-color: rgb(156, 101, 0); border-width: 1pt; padding: 2pt; font-size: 10pt; line-height: 12pt; font-family: Calibri; text-align: left; background-color: rgb(255, 235, 156); color: black;">
<span style="font-weight: bold; color: rgb(156, 101, 0);">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div dir="ltr">Thanks for the advice. Testing as you advise I do get the sub second non-zero digits.
<div><br>
</div>
<div>Are you saying that the commit you reference fixes the problem in 3.5.6?</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Tue, Sep 3, 2019 at 4:18 PM John Chang <<a href="mailto:jchang@skytap.com" target="_blank" data-ogsc="" style="">jchang@skytap.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-style:solid; border-left-color:rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">Hello, I am not getting non-zero sub-second timestamp digits. My <span style="font-family: Menlo; color: rgb(0, 0, 0);">/etc/syslog-ng/syslog-ng.conf file includes this global configuration:</span></div>
<div dir="ltr"><font color="#000000" face="Menlo" data-ogsc="" style=""><span style="font-size:11px"><br>
</span></font></div>
<div dir="ltr">
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"># First, set some global options.</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">options { frac-digits(3); chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"> owner("root"); group("adm"); perm(0640); stats_freq(0);</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"> bad_hostname("^gconfd$");</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">};</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"><br>
</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"><br>
</span></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">My </span>syslog-ng.conf also includes a sub-config file for sending the logs to a remote host, with this configuration:</p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<br>
</p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<br>
</p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">destination d_net {</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"> udp("loggerhost" port(30515) frac-digits(3) );</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">};</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
</p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">log { source(s_src); destination(d_net); };</span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"><br>
</span></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif"><br>
</font></span></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif">But all sub-second timestamp digits wind up being only zeroes on the remote "loggerhost", like this:</font></span></p>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<br>
</p>
<span style="font-family: Menlo; font-size: 11px; color: rgb(0, 0, 0);"></span>
<div><br>
</div>
<div>
<p style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures">2019-09-03T21:57:23.000+00:00 10.73.254.255 [info] [sshd] 3284 Accepted password for root from 10.72.0.186 port 50720 ssh2</span></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; color: rgb(0, 0, 0);">
<span style="font-variant-ligatures:no-common-ligatures"><font face="arial, sans-serif"><br>
</font></span></p>
<p style="margin: 0px; font-stretch: normal; line-height: normal; color: rgb(0, 0, 0);">
<font face="arial, sans-serif">The sending host is running syslog-ng 3.5.3. The receiving "loggerhost" is running 3.5.6 Thanks in advance for any help you can afford.</font></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>