The C_* family of timestamp macros work very similarly to R_ (received) and S_ (stamp), except C_ uses the current system time as of the macro expansion. The patch below uses cached_g_current_time() for performance reasons, but in case the minor caching is undesired, it's easy to convert to something else. Signed-off-by: Gergely Nagy <algernon@balabit.hu> --- lib/templates.c | 39 +++++++++++++++++++++++++++++++++++++-- 1 files changed, 37 insertions(+), 2 deletions(-) diff --git a/lib/templates.c b/lib/templates.c index cb0c1b5..63000a3 100644 --- a/lib/templates.c +++ b/lib/templates.c @@ -86,6 +86,7 @@ enum M_RECVD_OFS = M_TIME_MACROS_MAX, M_STAMP_OFS = 2 * M_TIME_MACROS_MAX, + M_CSTAMP_OFS = 3 * M_TIME_MACROS_MAX, }; #define M_TIME_MACROS 15 @@ -171,6 +172,29 @@ LogMacroDef macros[] = { "S_TZ", M_STAMP_OFS + M_TZ }, { "S_UNIXTIME", M_STAMP_OFS + M_UNIXTIME }, + { "C_DATE", M_CSTAMP_OFS + M_DATE }, + { "C_FULLDATE", M_CSTAMP_OFS + M_FULLDATE }, + { "C_ISODATE", M_CSTAMP_OFS + M_ISODATE }, + { "C_STAMP", M_CSTAMP_OFS + M_STAMP }, + { "C_YEAR", M_CSTAMP_OFS + M_YEAR }, + { "C_YEAR_DAY", M_CSTAMP_OFS + M_YEAR_DAY }, + { "C_MONTH", M_CSTAMP_OFS + M_MONTH }, + { "C_MONTH_WEEK", M_CSTAMP_OFS + M_MONTH_WEEK }, + { "C_MONTH_ABBREV", M_CSTAMP_OFS + M_MONTH_ABBREV }, + { "C_MONTH_NAME", M_CSTAMP_OFS + M_MONTH_NAME }, + { "C_DAY", M_CSTAMP_OFS + M_DAY }, + { "C_HOUR", M_CSTAMP_OFS + M_HOUR }, + { "C_MIN", M_CSTAMP_OFS + M_MIN }, + { "C_SEC", M_CSTAMP_OFS + M_SEC }, + { "C_WEEKDAY", M_CSTAMP_OFS + M_WEEK_DAY_ABBREV }, /* deprecated */ + { "C_WEEK_DAY", M_CSTAMP_OFS + M_WEEK_DAY }, + { "C_WEEK_DAY_ABBREV",M_CSTAMP_OFS + M_WEEK_DAY_ABBREV }, + { "C_WEEK_DAY_NAME", M_CSTAMP_OFS + M_WEEK_DAY_NAME }, + { "C_WEEK", M_CSTAMP_OFS + M_WEEK }, + { "C_TZOFFSET", M_CSTAMP_OFS + M_TZOFFSET }, + { "C_TZ", M_CSTAMP_OFS + M_TZ }, + { "C_UNIXTIME", M_CSTAMP_OFS + M_UNIXTIME }, + { "SDATA", M_SDATA }, { "MSGHDR", M_MSGHDR }, { "SOURCEIP", M_SOURCE_IP }, @@ -421,7 +445,7 @@ log_macro_expand(GString *result, gint id, gboolean escape, LogTemplateOptions * gchar buf[64]; gint length; time_t t; - LogStamp *stamp; + LogStamp *stamp, sstamp; glong zone_ofs; if (id >= M_TIME_FIRST && id <= M_TIME_LAST) @@ -438,7 +462,18 @@ log_macro_expand(GString *result, gint id, gboolean escape, LogTemplateOptions * id -= M_STAMP_OFS; stamp = &msg->timestamps[LM_TS_STAMP]; } - else + else if (id >= M_TIME_FIRST + M_CSTAMP_OFS && id <= M_TIME_LAST + M_CSTAMP_OFS) + { + GTimeVal tv; + + id -= M_CSTAMP_OFS; + cached_g_current_time(&tv); + sstamp.tv_sec = tv.tv_sec; + sstamp.tv_usec = tv.tv_usec; + sstamp.zone_offset = -1; + stamp = &sstamp; + } + else { g_assert_not_reached(); break; -- 1.7.0.4