[syslog-ng] syslog-ng logging with wrong year

[Balazs Scheidler]

On Tue, 2009-02-10 at 13:35 +0100, Mayashankar Mishra wrote:
>  
> I have syslog-ng 2.1.1 running, still i face the problem
>  
> when the date changed from  31 Dec 2008  to 1 Jan 2009, some of the
> log files still log as 1 Jan 2008
>  
> Is it resolved in higher version, and if yes which ?

Well, are you sure you are running 2.1.1? A related bug was fixed in
2.1beta1:

        * Fixed the year recognition heuristics as the older used the
          previous year in some cases when the client's clock was too fast.

This is how the code should look like (logmsg.c, log_msg_parse function)

      tm.tm_year = nowtm->tm_year;
      if (tm.tm_mon > nowtm->tm_mon + 1)
        tm.tm_year--;

This means that if the incoming month value is larger than the current
month, we assume that it came from the previous year.

E.g. if the current month is January, and the incoming date is claiming
March, then we assume that it came from the previous year.

-- 
Bazsi