Hi,

I was going to use ISODATE in my template, but cannot have the time zone offset appended due to outside factors. This is syslog-ng v2.0.9 on vanilla CentOS v5.2.

Without timezone information no one would be able to tell what is the exact time you're referring. Syslog-ng was designed to be able to collect logs from devices which are in different timezones, so ISODATE contains timezone information.

I initially thought of just making the date up from needed variables, but that raises a question about the template string. I needed this isodate output: YYYY-MM-DDThh:mm:ss So, I was trying to use this template: template t_myformat { template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $HOST $MSG\n"); template_escape(no); };

My issue is with the need to have the capital 't' (T) in between the $DAY and $HOUR without any spaces that ISO specifies. If I put the "T" directly after the $DAY, it will of course fail to find the variable $DAYT. I tried many variations of escaping the characters and only one worked, "\a" (bell). I ended up with this string that produces the correct output: template("$YEAR-$MONTH-$DAY\aT$HOUR:$MIN:$SEC $HOST $MSG\n");

Is this supposed to work? Is there a better or more correct method of defining the end of the $DAY variable and getting that "T" directly after the day and before the hour?

use ${DAY}T${HOUR} just like in script languages

Also, Is the TZOFFSET required on the ISODATE? And, Is there an easier method to change the ISODATE string, either in conf file or source code? I searched but did not see an applicable place in the code to change the ISODATE string parameters.

AFAIK you can't change it without modifying the source, and you shouldn't. ISODATE conforms to the ISO8601 standard. What you want to achieve would cause to fall back using localtime, which isn't a really usable option IMO. You still can have a custom timestamp if you want, so I don't see why should ISODATE be customisable. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.