[syslog-ng] RFC3339 fractional second logging

[Balazs Scheidler]

On Fri, 2006-02-10 at 08:29 -0500, rlott at ivhs.com wrote:
> Okay, I have this in my syslog-ng.conf:
> 
> options { dir_perm(0755); perm(0644); chain_hostnames(no);
> ts_format("iso");
>           keep_hostname(yes); };
> ...
> 
> #
> local0.debug                                          /var/log/ngr/ngr_3456_A.log
> 
> filter f_12 {
>         facility(local0) and level(debug.emerg);
> };
> 
> destination d_8 {
>         file("/var/log/ngr/ngr_3456_A_$MONTH$DAY$YEAR.log"
>         template("$R_ISODATE $HOST $MSG\n")
>         template_escape(no)
>         create_dirs(yes)
>         );
> };
> 
> log { source(local); filter(f_12); destination(d_8); };
> 
> And this is an entry from the corresponding log:
> 
> 2006-02-10T07:45:15-05:00 localhost <rest of message>
> 
> If the timestamp in this case is using the received timestamp, how is
> this being transmitted/delivered?  Is it being done in ASCII and, if
> so, is it possible that the fractional portions are not being
> included? 

There are two timestamps per message:
1) the one in the message as received from the peer, it will never
contain fractions except when the message was generated by syslog-ng and
this information was also sent by using a custom template (syslog-ng
tries to remain compatible with existing syslog devices by default, thus
it does 

-- 
Bazsi