[syslog-ng] timezones and macros

[Balazs Scheidler]

On May 6, 2013 5:53 PM, "Evan Rempel" <erempel at uvic.ca> wrote:
>
> I must be misunderstanding the timezone handling of syslog-ng because I
can't
> get it to behave the way I understand the manual to indicate.
>
> I have a few hosts that can only syslog in UTS, including the time zone,
> so all time stamps look like "2013-05-06T15:45:06+00:00".
>
> Two things happen.
>
> 1. The file name destination
/var/syslog/archive/syslog.$S_YEAR$S_MONTH$S_DAY.${S_HOUR}0000
>     that does not have any timezone specified, and the global option of
keep-timestamp is yes.
>
>     This destination uses the numbers from the UTC time stamp, but the
manual indicates in section
>     "2.5. Timezones and daylight saving" ... "Step 5. When macro
expansions are used in
>     the destination filenames, the local timezone is used."
>
>     The local time zone is "2013-05-06T08:45:06-07:00" so I expect to
have the log file of
>     /var/syslog/archive/syslog.20130506.080000
>     but instead, the log file is
>     /var/syslog/archive/syslog.20130506.150000

I'd have to check the code for this. ... I tried but it's difficult to read
code on a phone. It seems to do what the docs say, convert the timestamp to
the local timezone. But t I haven't tried at this time

>
> 2. If I am logging from many hosts, in many timezones, and am logging to
syslog servers
>     in different time zones, I would like the logs written in the time
zone of the syslog server.
>     I realize that there is a time-zone() setting for a destination, but
that requires a specific
>     time zone and can not handle daylight savings time.

It's been possible since 3.0 to use city names in timezone options.

Eg time-zone("Europe/Budapest") should work just fine.
>
>     Is there a way to configure a destination time zone that follows the
localhost daylight savings
>     time zone?
>
>
> Thanks.
>
> Evan.
>
______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130507/040cc68c/attachment.htm