[syslog-ng] keep_timestamp() and use_time_recvd() equivalent?

[Balazs Scheidler]

On Thu, 2010-12-09 at 19:23 +0000, Craig Bell wrote:
>   Q: Is option keep_timestamp(no) reasonably equivalent to
> use_time_recvd(yes)?
>  
>   Background: We recently upgraded from OSE v2.1 to v3.1.2.  This went
> well, but our global options include the deprecated  use_time_recvd().
> We see this advisory on startup:
>  
>   > Your configuration file uses an obsoleted keyword, please update
> your configuration; keyword='use_time_recvd', change='Use R_ or S_ 
> prefixed macros in templates'
>  
>   We don’t modify the default templates, so adding these for the first
> time wouldn’t be my first choice.  Instead, can I simply use global
> option keep_timestamp(no) as a replacement?   I looked around for
> advice, but didn’t see anything obvious.
>  

Yes, keep_timestamp(no) should be a good solution if you really want to
use the syslog server's timestamp, instead of the one in the message.

In case you needed both timestamps for some reason, you can still fall
back to using keep_timestamp(yes) and change the default templates.

I've pushed this patch to the 3.1 branch:

commit 6c615df992bf6f83e99d47a77d3379e36749bfab
Author: Balazs Scheidler <bazsi at balabit.hu>
Date:   Thu Dec 9 20:36:24 2010 +0100

    use_time_recvd: add slightly more clarification on the deprecated option
    
    use_time_recvd has been deprecated for a long time, but the warning only
    suggested the use of R_/S_ prefixed macros, while keep_timestamp() is just
    as good workaround, especially if someone doesn't care about the original
    timestamp and doesn't use templates at all.
    
    Reported-By: Craig Bell

In 3.2, this option has been removed.

-- 
Bazsi