millisecond timestamps
Hello! Is it possible to have syslog-ng support millisecond timestamps? And if it's possible, which version of syslog-ng supports it? Thanks.
Hello,
Is it possible to have syslog-ng support millisecond timestamps?
Possible yes ... in theory.
And if it's possible, which version of syslog-ng supports it?
None to my avail. The problem is not that someone didn't sit down and implement it, the problem lies in the missing specification, aka an RFC which would define how exactly support for millisecond granularity has to be done. If you're interested in the work of the people dealing with syslog enhancements, you might consider visiting the IETF Syslog Working Group: http://www.employees.org/~lonvick/index.shtml Two documents I recommend skimming through: http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-11.txt http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-15.txt The first one gives an idea how millisecond granularity can be implemented, the second one adds ideas about: "origin authentication, message integrity, replay-resistance, message sequencing, and detection of missing messages to the transmitted syslog messages." HTH and best regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc
Hello,
Two documents I recommend skimming through:
http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-11.txt http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-15.txt
The first one gives an idea how millisecond granularity can be implemented, the second one adds ideas about: "origin authentication, message integrity, replay-resistance, message sequencing, and detection of missing messages to the transmitted syslog messages."
Thanks a lot! Best regards, Ivan Pechorin.
On Mon, 2005-04-25 at 12:01 +0400, Ivan Pechorin wrote:
Hello,
Two documents I recommend skimming through:
http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-11.txt http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-15.txt
The first one gives an idea how millisecond granularity can be implemented, the second one adds ideas about: "origin authentication, message integrity, replay-resistance, message sequencing, and detection of missing messages to the transmitted syslog messages."
The current BETA of syslog-ng 2.0 (current version is at 1.9.4) supports this in its ISODATE time format: options { ts_format("iso"); }; Although it will only parse fractions of a second from network sources and will not attach it to local messages, but it's an easy thing to do. If you are willing to test I'd be happy to send a patch. /* RFC3339 timestamp, expected format: YYYY-MM-DDTHH:MM:SS[.frac]<+/->ZZ:ZZ */ -- Bazsi
The current BETA of syslog-ng 2.0 (current version is at 1.9.4) supports this in its ISODATE time format:
options { ts_format("iso"); };
Although it will only parse fractions of a second from network sources and will not attach it to local messages, but it's an easy thing to do. If you are willing to test I'd be happy to send a patch.
That will be nice! Which version should I patch? Latest snapshot of 2.0 ? Best regards, Ivan Pechorin.
participants (3)
-
Balazs Scheidler
-
Ivan Pechorin
-
Roberto Nibali