[syslog-ng] ISODATE without TZOFFSET

[Geller, Sandor (IT)]

Hi,

> I was going to use ISODATE in my template, but cannot have
> the time zone offset appended due to outside factors.  This
> is syslog-ng v2.0.9 on vanilla CentOS v5.2.

Without timezone information no one would be able to tell what
is the exact time you're referring. Syslog-ng was designed to
be able to collect logs from devices which are in different
timezones, so ISODATE contains timezone information.

> I initially thought of just making the date up from needed
> variables, but that raises a question about the template
> string.  I needed this isodate output:  YYYY-MM-DDThh:mm:ss
> So, I was trying to use this template:
> template t_myformat { template("$YEAR-$MONTH-$DAY
> $HOUR:$MIN:$SEC $HOST $MSG\n");  template_escape(no); };
>
> My issue is with the need to have the capital 't' (T) in
> between the $DAY and $HOUR without any spaces that ISO
> specifies.  If I put the "T" directly after the $DAY, it will
> of course fail to find the variable $DAYT.  I tried many
> variations of escaping the characters and only one worked,
> "\a" (bell).  I ended up with this string that produces the
> correct output:
> template("$YEAR-$MONTH-$DAY\aT$HOUR:$MIN:$SEC $HOST $MSG\n");
>
> Is this supposed to work?  Is there a better or more correct
> method of defining the end of the $DAY variable and getting
> that "T" directly after the day and before the hour?

use ${DAY}T${HOUR} just like in script languages

> Also, Is the TZOFFSET required on the ISODATE?  And, Is there
> an easier method to change the ISODATE string, either in conf
> file or source code?  I searched but did not see an
> applicable place in the code to change the ISODATE string parameters.

AFAIK you can't change it without modifying the source, and you
shouldn't. ISODATE conforms to the ISO8601 standard. What you want
to achieve would cause to fall back using localtime, which isn't
a really usable option IMO.

You still can have a custom timestamp if you want, so I don't see
why should ISODATE be customisable.

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.