Man, I knew that - sorry I missed it! (and normally, I do use the R_ macro, I just missed it in this user's example that was sent to me) Thanks for the response :-) ______________________________________________________________ Clayton Dukes ______________________________________________________________ On Fri, Dec 6, 2013 at 5:07 AM, Sandor Geller < Sandor.Geller@morganstanley.com> wrote:
Most likely the incoming log simply doesn't contain a high-res timestamp. You're using UNIXTIME (which is M_UNIXTIME unless keep_timestamp is set to no) so it is read from the log header. Instead of M_ macros you could use the timestamp when the message was received (R_ macros) or those which refer to the actual time when syslog-ng delivers a log (C_ macros).
On Fri, Dec 6, 2013 at 8:30 AM, Clayton Dukes <cdukes@gmail.com> wrote:
Hi, I have a system configured to microseconds logging, but for most of entries it's always zero - actually the only program which logs it correctly is the syslog-ng itself.
@1386239689.000000 13 blah
@1386239859.947724 45 syslog-ng shutting down; version='3.5.2'
@1386239860.304194 45 syslog-ng starting up; version='3.5.2'
@1386239860.337325 45 EOF on control channel, closing connection;
@1386239865.000000 13 blah
Anyone have an idea what I'm doing wrong?
Here's the config:
destination d_mydest{
program("/somepath"
template("@${UNIXTIME:--}\t${PRI:--}\t${MSGONLY}\n")
flags(no_multi_line)
flush_timeout(100)
frac_digits(6)
);
};
______________________________________________________________
Clayton Dukes ______________________________________________________________
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq