On Thu, 2010-12-09 at 19:23 +0000, Craig Bell wrote:

Q: Is option keep_timestamp(no) reasonably equivalent to use_time_recvd(yes)?

Background: We recently upgraded from OSE v2.1 to v3.1.2. This went well, but our global options include the deprecated use_time_recvd(). We see this advisory on startup:

...

Your configuration file uses an obsoleted keyword, please update your configuration; keyword='use_time_recvd', change='Use R_ or S_ prefixed macros in templates'

We don’t modify the default templates, so adding these for the first time wouldn’t be my first choice. Instead, can I simply use global option keep_timestamp(no) as a replacement? I looked around for advice, but didn’t see anything obvious.

Yes, keep_timestamp(no) should be a good solution if you really want to use the syslog server's timestamp, instead of the one in the message. In case you needed both timestamps for some reason, you can still fall back to using keep_timestamp(yes) and change the default templates. I've pushed this patch to the 3.1 branch: commit 6c615df992bf6f83e99d47a77d3379e36749bfab Author: Balazs Scheidler <bazsi@balabit.hu> Date: Thu Dec 9 20:36:24 2010 +0100 use_time_recvd: add slightly more clarification on the deprecated option use_time_recvd has been deprecated for a long time, but the warning only suggested the use of R_/S_ prefixed macros, while keep_timestamp() is just as good workaround, especially if someone doesn't care about the original timestamp and doesn't use templates at all. Reported-By: Craig Bell In 3.2, this option has been removed. -- Bazsi