[syslog-ng] Timezone problem?!

Charles Chan digiblue at gmail.com
Thu Jan 15 08:03:14 CET 2009


Recently I use the syslog-ng for log collection environment encountered a
time zone problem,hope somebody can help me.Thanks
The environment is like this:
The apache server(PDT timezone,UTC-8) forword apache log through syslog to
the syslog-ng server(CST timezone,UTC+8).
The server with same time zones no problem between the forward.
Syslog-ng test configuration is as follows:
destination int_apache (file ( "/ disk3/cookie_logs/pid1 / $ YEAR-$ MONTH-$
DAY / $ (HOST). apache.log" time_zone (-08:00) template ( "$ DAY-$ HOUR $
S_DAY-$ S_HOUR $ R_DAY-$ R_HOUR $ $ ISODATE $ MSGONLY \ n ") template_escape
(no)););

The original apache log is:
58.240.69.161 - - - [14/Jan/2009: 22:27:47 -0800] "GET /
www.example.com/HTTP/1.1" 200 2028 "-" "Mozilla/4.0 ( compatible; MSIE
7.0; Windows NT 5.1)
"

The syslog-ng server generated log is:
14-22 14-22 14-22 2009-01-14T22 :27:47-08: 00 58.240.69.161 - - -
[14/Jan/2009: 22:27:47 -0800] "GET / www.example. com / HTTP/1.1 "200 2028"
- "" Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) "

Originally generated documents should be kept in
/disk3/cookie_logs/pid1/2009-01-14
However, the actual file is stored in the
/disk3/cookie_logs/pid1/2009-01-15
It can be seen, in fact, syslog-ng configuration item file() use the $DAY
and template()  use the $DAY not with a identical Macros. Is this the
syslog-ng a bug? or I configuration errors. Who can help me answer
you?Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090115/0126cc0a/attachment.htm 


More information about the syslog-ng mailing list