[syslog-ng] Timezone problem?!

[Balazs Scheidler]

On Tue, 2009-02-10 at 11:47 +0800, Charles Chan wrote:
> We update syslog-ng to 3.0.1,configuration same with 2.1,but the
> problem still exists,In 3.0 just have two parameter about
> timezone("time_zone" and "timezone"),not find specify a location by
> name instead of using plain timezone offsets which do not support
> day-light-saving as you say.The Doc not include "timezone" parameter
> deail  example， Can you help me fix the problem and give me some
> config examples?

When using timezone() in 3.0, you can reference the name of the
timezone, e.g.

timezone("Europe/Budapest");

The name of the timezone can either be a direct timezone offset
reference as earlier (e.g. +01:00), or the name of a timezone info file
under /usr/share/zoneinfo.

I'm Ccing the documentation team, to clarify the documentation about
this.

> 
> 2009/1/17 Balazs Scheidler <bazsi at balabit.hu>
>         
>         On Thu, 2009-01-15 at 15:03 +0800, Charles Chan wrote:
>         > Recently I use the syslog-ng for log collection environment
>         > encountered a time zone problem,hope somebody can help
>         me.Thanks
>         > The environment is like this:
>         > The apache server(PDT timezone,UTC-8) forword apache log
>         through
>         > syslog to the syslog-ng server（CST timezone，UTC＋8）.
>         > The server with same time zones no problem between the
>         forward.
>         > Syslog-ng test configuration is as follows:
>         > destination int_apache (file ( "/ disk3/cookie_logs/pid1 / $
>         YEAR-$
>         > MONTH-$ DAY / $ (HOST). apache.log" time_zone (-08:00)
>         template ( "$
>         > DAY-$ HOUR $ S_DAY-$ S_HOUR $ R_DAY-$ R_HOUR $ $ ISODATE $
>         MSGONLY \ n
>         > ") template_escape (no)););
>         >
>         > The original apache log is:
>         > 58.240.69.161 - - - [14/Jan/2009: 22:27:47 -0800] "GET /
>         > www.example.com/ HTTP/1.1" 200 2028 "-" "Mozilla/4.0
>         ( compatible;
>         > MSIE 7.0; Windows NT 5.1) "
>         >
>         > The syslog-ng server generated log is:
>         > 14-22 14-22 14-22 2009-01-14T22 :27:47-08: 00 58.240.69.161
>         - - -
>         > [14/Jan/2009: 22:27:47 -0800] "GET / www.example. com /
>         HTTP/1.1 "200
>         > 2028" - "" Mozilla/4.0 (compatible; MSIE 7.0; Windows NT
>         5.1) "
>         >
>         > Originally generated documents should be kept in
>         > /disk3/cookie_logs/pid1/2009-01-14
>         > However, the actual file is stored in the
>         > /disk3/cookie_logs/pid1/2009-01-15
>         > It can be seen, in fact, syslog-ng configuration item file()
>         use the
>         > $DAY and template()  use the $DAY not with a identical
>         Macros. Is this
>         > the syslog-ng a bug? or I configuration errors. Who can help
>         me answer
>         > you?Thanks!
>         
>         
>         Well, as I researched this area, there's some version
>         dependance here.
>         In syslog-ng 2.1 (and probably 2.0, but I haven't checked) if
>         you use
>         the time related macros in a filename, then the timestamps are
>         converted
>         to use the local timezone of the syslog-ng process. In the
>         examples
>         above, the time_zone() option only affects the _contents_ of
>         the file,
>         and not the filenames.
>         
>         In 3.0 this "behaviour" is fixed and the timezone of the
>         timestamp is
>         used, without alteration.
>         
>         (and NOTE that in 3.0 the timezone handling was expanded
>         significantly,
>         e.g. you can specify a location _by name_ instead of using
>         plain
>         timezone offsets which do not support day-light-saving)
>         
>         --
>         Bazsi
>         
>         
>         ______________________________________________________________________________
>         Member info:
>         https://lists.balabit.hu/mailman/listinfo/syslog-ng
>         Documentation:
>         http://www.balabit.com/support/documentation/?product=syslog-ng
>         FAQ: http://www.campin.net/syslog-ng/faq.html
>         
> 
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
> 
-- 
Bazsi