[syslog-ng]Year off the first of the month

[Balazs Scheidler]

On Wed, Jul 09, 2003 at 03:50:02PM -0500, Keith Olmstead wrote:
> Hello,
> 
> Something strange is happening.  At the first of the month I have logs
> that create a dir for 2002, one year ago and log breafly for 2002.  It
> seems to be happening at the first of the month and only last breafly. 
> Does anyone know why this is happening?

this is the code that guesses the current year (as that is not included in
the log message):

			nowtm = localtime(&now);
                        memset(&tm, 0, sizeof(tm));
                        strptime(lm->date->data, "%b %e %H:%M:%S", &tm);
                        tm.tm_isdst = -1;
                        tm.tm_year = nowtm->tm_year;
                        if (tm.tm_mon > nowtm->tm_mon)
                                tm.tm_year--;
                        lm->stamp = mktime(&tm);

that means that if the received month is greater than the local month, the
current year is assumed to be the previous year. The reason for this is to
cover the case when messages time stamped with December dates are processed
in January.

Maybe this 'autodetection' should be changed to require at least two months
slip. Try this one:

			if (tm.tm_mon > nowtm->tm_mon + 1)
				tm.tm_year--;

What do the others think?

In any case the reason for this is that you have a sender with incorrect
clock.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1