ts_format(iso); frac_digits(6); == 000000+00:00 always ?
Hello, I wish to enable the ISO timestamp format, and to have a granularity of six digits. I have enabled the following in my global options : frac_digits (6); ts_format(iso); The timestamp format is enabled as expected, but the fractional digits always appear as straight zeros. For example : 2010-07-12T16:49:27.000000+00:00 s_sys@srv-01 postfix/qmgr[2851]: 2EF1B1F9034E: removed Is there a way to enable the desired millisecond timestamps ? Details : $ uname -s -r -v -p -o Linux 2.6.18-194.el5 #1 SMP Fri Apr 2 14:58:14 EDT 2010 x86_64 GNU/Linux $ cat /etc/redhat-release CentOS release 5.5 (Final) $ rpm -qa | grep syslog-ng syslog-ng-2.1.4-1.el5 Thank you, and have an excellent day. -- Daniel Maher <dma PLUS syslogng AT witbe DOT net>
I'm assuming youre not using any custom template to rewrite the message before its outputted. In which case it will use the time provided by the sending host. If the sending host doesnt provide a microsecond value in the timestamp, microseconds will always be 0s. If you want higher granularity, you either need to configure the sending host to do so, or create a template with the R_ISODATE value (uses received time instead of sent time). Sent: Monday, July 12, 2010 11:01:22 AM From: Daniel Maher <dma+syslogng@witbe.net> To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] ts_format(iso); frac_digits(6); == 000000+00:00 always ?
Hello,
I wish to enable the ISO timestamp format, and to have a granularity of six digits. I have enabled the following in my global options :
frac_digits (6); ts_format(iso);
The timestamp format is enabled as expected, but the fractional digits always appear as straight zeros. For example :
2010-07-12T16:49:27.000000+00:00 s_sys@srv-01 postfix/qmgr[2851]: 2EF1B1F9034E: removed
Is there a way to enable the desired millisecond timestamps ?
Details :
$ uname -s -r -v -p -o Linux 2.6.18-194.el5 #1 SMP Fri Apr 2 14:58:14 EDT 2010 x86_64 GNU/Linux $ cat /etc/redhat-release CentOS release 5.5 (Final) $ rpm -qa | grep syslog-ng syslog-ng-2.1.4-1.el5
Thank you, and have an excellent day.
On 07/12/2010 08:08 PM, Patrick H. wrote:
I'm assuming youre not using any custom template to rewrite the message before its outputted. In which case it will use the time provided by the sending host. If the sending host doesnt provide a microsecond value in the timestamp, microseconds will always be 0s. If you want higher granularity, you either need to configure the sending host to do so, or create a template with the R_ISODATE value (uses received time instead of sent time).
Thank you for your reply. I created a simple template with the R_ISODATE value and that worked perfectly. -- Daniel Maher <dma PLUS syslogng AT witbe DOT net>
On Tue, 2010-07-13 at 11:28 +0200, Daniel Maher wrote:
On 07/12/2010 08:08 PM, Patrick H. wrote:
I'm assuming youre not using any custom template to rewrite the message before its outputted. In which case it will use the time provided by the sending host. If the sending host doesnt provide a microsecond value in the timestamp, microseconds will always be 0s. If you want higher granularity, you either need to configure the sending host to do so, or create a template with the R_ISODATE value (uses received time instead of sent time).
Thank you for your reply. I created a simple template with the R_ISODATE value and that worked perfectly.
you can also use the keep_timestamp() option on the source, which when set to "no" causes syslog-ng to overwrite the timestamp in the received log message with the current time. -- Bazsi
participants (3)
-
Balazs Scheidler
-
Daniel Maher
-
Patrick H.