[syslog-ng] Milliseconds in timestamp and black magic

[Balazs Scheidler]

On Fri, 2009-08-21 at 21:19 +0200, Sergei Zhirikov wrote:
> Hi,
> 
> I'm observing something mysterious with milliseconds in timestamps.
> I set frac_digits() in the global options and then I have a rewriter and 
> a template. Something like this:
> 
> options { frac_digits(3); };
> 
> source s { internal(); }
> 
> rewrite r { set("$ISODATE", value("MYDATE")); };
> 
> template t { template("$ISODATE ($MYDATE) $HOST $MSGHDR$MESSAGE\n"); };
> 
> destination d { file("/var/log/test.log" template(t)); };
> 
> log { source(s); rewrite(r); destination(d); };
> 
> To my total surprise the expanded value of $ISODATE in the log file 
> contains fraction part, but the value of $MYDATE does not! Aren't they 
> supposed to be the same because of the rewrite rule? Or am I doing 
> something wrong? (I'm using syslog-ng 3.0.4 on Linux).

well, you might be right that this is a discrepancy, I might call this a
bug as well, but there's an explanation:

frac_digits() is a per-destination option and the global frac_digits()
only affect destinations.

rewrite rules (and filename macros for example) don't inherit that value
and always use 0 frac_digits.

The per-destination options for template formatting are the followings:
  * timestamp format (e.g. $DATE expansion)
  * timezone
  * frac_digits
  * sequence number ($SEQNUM)

These are not controllable for rewrite rules right now and neither are
when macros are used in filenames.



-- 
Bazsi