[syslog-ng] Trouble with microseconds

[Clayton Dukes]

Man, I knew that - sorry I missed it! (and normally, I do use the R_ macro,
I just missed it in this user's example that was sent to me)

Thanks for the response :-)



______________________________________________________________

Clayton Dukes
______________________________________________________________


On Fri, Dec 6, 2013 at 5:07 AM, Sandor Geller <
Sandor.Geller at morganstanley.com> wrote:

> Most likely the incoming log simply doesn't contain a high-res
> timestamp. You're using UNIXTIME (which is M_UNIXTIME unless
> keep_timestamp is set to no) so it is read from the log header.
> Instead of M_ macros you could use the timestamp when the message was
> received (R_ macros) or those which refer to the actual time when
> syslog-ng delivers a log (C_ macros).
>
> On Fri, Dec 6, 2013 at 8:30 AM, Clayton Dukes <cdukes at gmail.com> wrote:
> > Hi,
> > I have a system configured to microseconds logging, but for most of
> entries
> > it's always zero - actually the only program which logs it correctly is
> the
> > syslog-ng itself.
> >
> > @1386239689.000000 13 blah
> >
> > @1386239859.947724 45 syslog-ng shutting down; version='3.5.2'
> >
> > @1386239860.304194 45 syslog-ng starting up; version='3.5.2'
> >
> > @1386239860.337325 45 EOF on control channel, closing connection;
> >
> > @1386239865.000000 13 blah
> >
> >
> > Anyone have an idea what I'm doing wrong?
> >
> >
> > Here's the config:
> >
> > destination d_mydest{
> >
> >     program("/somepath"
> >
> >         template("@${UNIXTIME:--}\t${PRI:--}\t${MSGONLY}\n")
> >
> >         flags(no_multi_line)
> >
> >         flush_timeout(100)
> >
> >         frac_digits(6)
> >
> >     );
> >
> > };
> >
> > ______________________________________________________________
> >
> > Clayton Dukes
> > ______________________________________________________________
> >
> >
> ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation:
> > http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.balabit.com/wiki/syslog-ng-faq
> >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20131206/f3bb6a17/attachment.htm