[syslog-ng] timezones and macros

[Evan Rempel]

I must be misunderstanding the timezone handling of syslog-ng because I can't
get it to behave the way I understand the manual to indicate.

I have a few hosts that can only syslog in UTS, including the time zone,
so all time stamps look like "2013-05-06T15:45:06+00:00".

Two things happen.

1. The file name destination /var/syslog/archive/syslog.$S_YEAR$S_MONTH$S_DAY.${S_HOUR}0000
    that does not have any timezone specified, and the global option of keep-timestamp is yes.

    This destination uses the numbers from the UTC time stamp, but the manual indicates in section
    "2.5. Timezones and daylight saving" ... "Step 5. When macro expansions are used in
    the destination filenames, the local timezone is used."

    The local time zone is "2013-05-06T08:45:06-07:00" so I expect to have the log file of
    /var/syslog/archive/syslog.20130506.080000
    but instead, the log file is
    /var/syslog/archive/syslog.20130506.150000

2. If I am logging from many hosts, in many timezones, and am logging to syslog servers
    in different time zones, I would like the logs written in the time zone of the syslog server.
    I realize that there is a time-zone() setting for a destination, but that requires a specific
    time zone and can not handle daylight savings time.

    Is there a way to configure a destination time zone that follows the localhost daylight savings
    time zone?


Thanks.

Evan.