<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
I can observe the same behavior as you, on 3.8.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
It was fixed in 3.20 with <a href="https://github.com/syslog-ng/syslog-ng/commit/f65528392071a65c1962046607e921f373fd8351" style="">https://github.com/syslog-ng/syslog-ng/commit/f65528392071a65c1962046607e921f373fd8351</a></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Regards,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Attila</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Attila Szakacs (aszakacs) <Attila.Szakacs@oneidentity.com><br>
<b>Sent:</b> Tuesday, February 4, 2020 3:19 PM<br>
<b>To:</b> Matus UHLAR - fantomas <uhlar@fantomas.sk>; syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] UTC in C_ macros?</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div style="background-color:#FFEB9C; width:100%; border-style:solid; border-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:#9C6500; font-weight:bold">CAUTION:</span> This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Hi Matus,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
C_ macros should handle time-zones (at least on a fresh version). I will check it on 3.8 soon.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Regards,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Attila</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Matus UHLAR - fantomas <uhlar@fantomas.sk><br>
<b>Sent:</b> Tuesday, February 4, 2020 2:38 PM<br>
<b>To:</b> syslog-ng@lists.balabit.hu <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> [syslog-ng] UTC in C_ macros?</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">CAUTION: This email originated from outside of the organization. Do not follow guidance, click links, or open attachments unless you recognize the sender and know the content is safe.<br>
<br>
<br>
Hello,<br>
<br>
I have tried to RTFS but no success.<br>
are C_ dates in UTC or should they be?<br>
<br>
On 31.01.20 13:34, Matus UHLAR - fantomas wrote:<br>
>I have syslog-ng OSE 3.8 on debian 9 server (soon to be upgraded).<br>
><br>
>when I receive syslog lines using the syslog protocol, I found out that C_*<br>
>macros seem to contain date in UTC format (one hour than our current zone).<br>
><br>
>I have tried to use following template:<br>
><br>
>"${C_DATE} ${R_DATE} HOST ${HOST} FULLHOST ${FULLHOST} HOST_FROM ${HOST_FROM} FULLHOST_FROM ${FULLHOST_FROM} ${MESSAGE}\n"<br>
><br>
>with following result:<br>
><br>
>Jan 31 10:42:06 Jan 31 11:42:07 HOST fantomas FULLHOST fantomas HOST_FROM 195.80.174.185 FULLHOST_FROM 195.80.174.185 Configuration reload request received, reloading configuration;<br>
><br>
><br>
>Is there any reason why C_DATE should be in different time zone than R_DATE?<br>
>timezones are not configured on either of servers, both servers are in CET<br>
>(DST+1)<br>
<br>
<br>
--<br>
Matus UHLAR - fantomas, uhlar@fantomas.sk ; <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.fantomas.sk%2F&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C1a0bf510d5c841bddbc408d7a97d34e2%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164227532477607&sdata=4jhe1EeZ2Wo0j0HNHWmecmd%2B2yI8CJndwqDHYU2Cfks%3D&reserved=0" originalsrc="http://www.fantomas.sk/" shash="d2yYY0IbeCocDGZKoHtRdbFS1LEYzXF+NtsUSRkyfC+eikUyfCjCx9XLySjo2n7l8qQ62ZJyc+T3Kt/ajvP93HW+Zu4sgj+2NdHl2Lf3tZpazJdpl+fxmo2hfWUlNBhiBup65HjsdfKYYbv7C69p3WW8jALAWrqR5DtDk2Fzmik=">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.fantomas.sk%2F&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C3efb1d3651ee47a184c808d7a9777bff%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164202984527642&sdata=%2F0rasfGDvvua7Z7Nbgwfj4naS21z6Y6ZaH%2B8%2FztY%2BxQ%3D&reserved=0</a><br>
Warning: I wish NOT to receive e-mail advertising to this address.<br>
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.<br>
99 percent of lawyers give the rest a bad name.<br>
______________________________________________________________________________<br>
Member info: <a href="https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C1a0bf510d5c841bddbc408d7a97d34e2%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164227532487601&sdata=c6D8ypQ%2F6AqFsjxWo%2BE7ncIdCtjduudbGVznTdNFj5w%3D&reserved=0" originalsrc="https://lists.balabit.hu/mailman/listinfo/syslog-ng" shash="jWFuuUk94sMP8vg38CqVkSPHFROry2tQ0NABGO9EpA41DiJyoaEio+RYIEyrrq36TkHG67cjMCnzBT42qLcpaUnZeSwgQU0I991KPAPa3rteibQno9Vj4kbGWKyt4H1eI3dx2QLTNueCRHwS9N75dALYSLerhJzAMPb5DLZ58o4=">
https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.balabit.hu%2Fmailman%2Flistinfo%2Fsyslog-ng&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C3efb1d3651ee47a184c808d7a9777bff%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164202984527642&sdata=8yKSgI7JWIMVHPXz2wf%2Fc2YmT1NEyJ7bxGDKYyu2LBo%3D&reserved=0</a><br>
Documentation: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C1a0bf510d5c841bddbc408d7a97d34e2%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164227532497598&sdata=LwsWR9s2p5PEAMnLdvAbNn%2BUwD1n%2B8vVdhhHrPo4ZUE%3D&reserved=0" originalsrc="http://www.balabit.com/support/documentation/?product=syslog-ng" shash="CIwQoIt7FuZLgaamUILztg4Nca+gfax/VPkl0bRw5g04ei9+pQ/Lv223vgEeL0NGUDM5NiwQvT6DrTP+Yo1BZ5bWaDFhFz4Sd00A6EyNWyi4CPDiYf7GdLeQlkzcsy9Yurw1Nr1/fvKEPE985XC08+ox3ggaay8fNhsXoFzaf2s=">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C3efb1d3651ee47a184c808d7a9777bff%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164202984527642&sdata=Nq96M%2BWi0PYjji7qkO%2Ft2NilOcdZVccankfdxGFRzQ4%3D&reserved=0</a><br>
FAQ: <a href="https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C1a0bf510d5c841bddbc408d7a97d34e2%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164227532497598&sdata=pfq6vytqysnksPz3ETZKf08GC3%2F%2FvlsCPv2zz69h3EU%3D&reserved=0" originalsrc="http://www.balabit.com/wiki/syslog-ng-faq" shash="xxo2axHyUxmgScfmGTdlvayF2Bt+uRxCUrAltkNvdlkowcVPzj1OkHpZDi85FGlQDRHkKcDi7hg7YWb91IE2PuMQ4uFyoQuxuHORIQ0D1Rum/a4lk+Uov7MEPyQ7SxgMNhL48IaKrmTh5wMXSyr907iUEnK0leZxjBSZhR1helI=">
https://nam05.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=02%7C01%7CAttila.Szakacs%40oneidentity.com%7C3efb1d3651ee47a184c808d7a9777bff%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C637164202984527642&sdata=F8m1Bv%2F2SVHYJxt4BRld3XUcsEHHff4H5s9%2FgdHWwuI%3D&reserved=0</a><br>
<br>
</div>
</span></font></div>
</div>
</div>
</body>
</html>