[syslog-ng] timezones

[Szeti, Balazs]

Yes.
I send these line to syslog-ng's TCP port with telnet:
<140>2006-11-05T05:15:15+01:00 1 2 3
<140>2006-11-05T05:15:15+02:00 1 2 3
<140>2006-11-05T05:15:15+03:00 1 2 3 

I use syslog-ng 2.0.0rc3.

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs
Scheidler
Sent: Thursday, November 09, 2006 5:25 PM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] timezones

On Thu, 2006-11-09 at 16:04 +0100, Szeti, Balazs wrote:
> Hello!
> 
> I'm trying to log messages with ISO timestamps from different
timezones.
> Example through TCP:
> <140>2006-11-05T05:15:15+01:00 1 2 3
> <140>2006-11-05T05:15:15+02:00 1 2 3
> <140>2006-11-05T05:15:15+03:00 1 2 3
> 
> The syslog-ng's node is in +01:00 timzone. I left all the time_zone() 
> on default.
> 
> Template used:
> template t_year { template("$S_ISODATE $R_ISODATE $S_HOUR: 
> $MSGONLY\n"); };
> 
> Result in the log:
> 2006-11-05T05:15:15.000000+01:00 2006-11-09T16:12:10+01:00 05: 2 3 
> 2006-11-05T07:15:15.000000+02:00 2006-11-09T16:11:41+01:00 07: 2 3 
> 2006-11-05T09:15:15.000000+03:00 2006-11-09T16:12:37+01:00 09: 2 3
> 
> There's nothing wrong with the R_ISODATE, but I don't understand the 
> S_ISODATE. When I log with the syslog-ng node timezone it writes the 
> right value, but when I change the timezone in the TCP message the 
> S_HOUR increases! I would like to see the original timestamp from the 
> message and the R_ISODATE right next to each other.
> Why is the S_ISODATE increased?
> Can S_HOUR now be used in file name templates???
> 

Does your client include timezone information in the messages it sends?
syslog-ng can do so, but only if you change the protocol template
(assuming you are using syslog-ng 2.0.x)

--
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html