On May 6, 2013 5:53 PM, "Evan Rempel" <erempel@uvic.ca> wrote:
I must be misunderstanding the timezone handling of syslog-ng because I
can't
get it to behave the way I understand the manual to indicate.
I have a few hosts that can only syslog in UTS, including the time zone, so all time stamps look like "2013-05-06T15:45:06+00:00".
Two things happen.
1. The file name destination /var/syslog/archive/syslog.$S_YEAR$S_MONTH$S_DAY.${S_HOUR}0000 that does not have any timezone specified, and the global option of keep-timestamp is yes.
This destination uses the numbers from the UTC time stamp, but the manual indicates in section "2.5. Timezones and daylight saving" ... "Step 5. When macro expansions are used in the destination filenames, the local timezone is used."
The local time zone is "2013-05-06T08:45:06-07:00" so I expect to have the log file of /var/syslog/archive/syslog.20130506.080000 but instead, the log file is /var/syslog/archive/syslog.20130506.150000
I'd have to check the code for this. ... I tried but it's difficult to read code on a phone. It seems to do what the docs say, convert the timestamp to the local timezone. But t I haven't tried at this time
2. If I am logging from many hosts, in many timezones, and am logging to
syslog servers
in different time zones, I would like the logs written in the time
zone of the syslog server.
I realize that there is a time-zone() setting for a destination, but
that requires a specific
time zone and can not handle daylight savings time.
It's been possible since 3.0 to use city names in timezone options. Eg time-zone("Europe/Budapest") should work just fine.
Is there a way to configure a destination time zone that follows the
localhost daylight savings
time zone?
Thanks.
Evan.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq