[syslog-ng] ISODATE without TZOFFSET

Del Riesgo, Christopher D christopher.d.delriesgo at boeing.com
Wed Sep 10 18:42:13 CEST 2008

I was going to use ISODATE in my template, but cannot have the time zone
offset appended due to outside factors.  This is syslog-ng v2.0.9 on
vanilla CentOS v5.2.
I initially thought of just making the date up from needed variables,
but that raises a question about the template string.  I needed this
isodate output:  YYYY-MM-DDThh:mm:ss
So, I was trying to use this template:
template t_myformat { template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $HOST
$MSG\n");  template_escape(no); };
My issue is with the need to have the capital 't' (T) in between the
$DAY and $HOUR without any spaces that ISO specifies.  If I put the "T"
directly after the $DAY, it will of course fail to find the variable
$DAYT.  I tried many variations of escaping the characters and only one
worked, "\a" (bell).  I ended up with this string that produces the
correct output:
template("$YEAR-$MONTH-$DAY\aT$HOUR:$MIN:$SEC $HOST $MSG\n");
Is this supposed to work?  Is there a better or more correct method of
defining the end of the $DAY variable and getting that "T" directly
after the day and before the hour?
Also, Is the TZOFFSET required on the ISODATE?  And, Is there an easier
method to change the ISODATE string, either in conf file or source code?
I searched but did not see an applicable place in the code to change the
ISODATE string parameters.
I search the list archives and after countless other google searches, I
haven't seen this issue come up before.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080910/228f0cc7/attachment.htm 

More information about the syslog-ng mailing list