On Wed, 2007-09-19 at 12:03 +0200, Thomas Gelf wrote:
Hi list,
timezones and daylight saving time are causing me a serious headache, and I hope that someone can give me a hint :-) Let's start:
* I have several servers sending syslog (clients) and also several syslog servers (receivers)
* Most (all) of them are running syslog-ng :o)
* Local timezone is Europe/Rome (CEST), that's GMT +01:00 and +02:00 while summertime
* All systems have their system clock set to UTC and correct local settings (Europe/Rome)
* syslog is written to local files on each server (just to be sure to miss nothing in case of network outages etc) + local files on syslog reciever (rotation & archive) + mysql db on syslog reciever (for short history & web app)
* syslog reciever is currently getting about 60 syslog entries per second, once in full production that will be something like 200 per second
Even if all of my servers are (at least right now) residing in the same timezone I would like to do things the right way. Therefore in my believes timestamp should be saved as a UTC value - correct localized presentation should be up to my web application.
Documentation is telling me that:
2.6. Daylight saving changes The syslog-ng application receives the timezone and daylight saving information from the operating system it is installed on. If the operating system handles daylight saving correctly, so does syslog-ng.
This is great news :-) But what exactly does it mean to me? As told before all my systems are running with UTC system clock and CEST local timezone.
Should I set recv_time_zone("+01:00")? Doesn't make sense to me, as I need CEST: +01:00 and +02:00!? Should I set send_time_zone('00:00') on each syslog client? Can I trust S_UNIXTIME and / or R_UNIXTIME (instead of R_HOUR & Co)?
If the clients run syslog-ng, then you should use the ISO timestamp which includes timezone information. In that case you don't need to adjust recv_time_zone() at all. If you want syslog-ng to output an UTC timestamp, then again you won't need to change any of the timezone related parameters, incoming messages are converted to UTC internally, so S_UNIXTIME and R_UNIXTIME expand to the correct value. (UTC is a timezone independent time representation, it is the same everywhere). -- Bazsi