[syslog-ng]millisecond timestamps

[Balazs Scheidler]

On Mon, 2005-04-25 at 12:01 +0400, Ivan Pechorin wrote:
> Hello,
> 
> > Two documents I recommend skimming through:
> 
> >     http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-11.txt
> >     http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-15.txt
> 
> > The first one gives an idea how millisecond granularity can be 
> > implemented, the second one adds ideas about: "origin authentication,
> > message integrity, replay-resistance, message sequencing, and detection 
> > of missing messages to the transmitted syslog messages."

The current BETA of syslog-ng 2.0 (current version is at 1.9.4) supports
this in its ISODATE time format:

options { ts_format("iso"); };

Although it will only parse fractions of a second from network sources
and will not attach it to local messages, but it's an easy thing to do.
If you are willing to test I'd be happy to send a patch.

/* RFC3339 timestamp, expected format: YYYY-MM-DDTHH:MM:SS[.frac]<+/->ZZ:ZZ */


-- 
Bazsi