On Tue, 2004-02-03 at 10:43, Serge Torop wrote:
On Tue, 2 Dec 2003, Niels Burmeister wrote:
Am 2003.12.02 12:36 schrieb Piotr Woliе└ski:
Hello,
I have PLD Linux kernel 2.4.20 and syslog-ng-1.6.0-0.rc3.2 I put into into syslog-ng.conf lines (for test purpose): [...] Now i can see directiories like that: /var/log/hosts/localhost/2003/2003/12/01 /var/log/hosts/localhost/2003/2003/12/02 that's OK.
But also: /var/log/hosts/localhost/2002/12/31
Inside that dir files: auth, authpriv, local7.
upgrade to >=1.6.0rc4, it's a known bug
That "bug" is still there, but the problem appears to come from the locale settings (locale).
I tried to strace data from logger to syslog-ng (see the contents of my syslog-ng.conf at the end of this message).
I.
In my case, LC_TIME="ru_RU.koi8r".
1. logger -p local4.info abcdefgh 2. strace -p syslog-ng.pid -t
15:09:03 read(9, "<166>\361\316\327 28 15:09:03 tsp: abcdef"..., 2048) = 35 ^^^^^^^^^^^^^^^^^ - russian date format of "15:09:03 Wed Jan 28"
I think logger the one which should be fixed. it should send its timestamp independently of its current locale. The date stamp is part of the syslog protocol. syslog-ng parses this date stamp using strptime() like this: strptime((char *) lm->date->data, "%b %e %H:%M:%S", &tm) The call to strptime() probably fails, and the timestamp you get has no real connection to the timestamp received in the message. and autodetects year (as it is not included in the message) like this: tm.tm_year = nowtm->tm_year; if (tm.tm_mon > nowtm->tm_mon + 1) tm.tm_year--; tm is the received timestamp, nowtm is the current time
15:09:03 time(NULL) = 1075291743 15:09:03 time(NULL) = 1075291743 15:09:03 open("/var/log/messages.local4.info",
-- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1