[syslog-ng] Millisecond Resolution Timestamps

[David Hauck]

Hello,

I'm using the following global options in order to format messages with millisecond resolution:

  ts_format(iso);
  frac_digits(3);

Although the initial (syslog-ng starting) message appears to include sub-second resolution subsequent messages do not:

20140415 10:19:23.590 notice syslog(syslog-ng):syslog-ng starting up; version='3.5.4.1'
...
20140415 10:19:33.000 notice authpriv(su):FAILED su for test by root
...
20140415 10:20:11.000 notice user(root):test

This includes messages originating from any number of sources (including all processes that log via syslog()), *except* messages originating from the kernel (these always seem to have sub-second resolution). Does anyone have any ideas what might be going on here?

Thanks,
-David

PS: the timestamp formatting above is done via a simple template. Regardless of this (re-)formatting nominal iso messages also exhibit this limitation. For e.g.,:

2014-04-14T15:23:48.000-07:00 host99738728 nasysconfd: exit code 0 for /netacquire/bin/sysconf/osinfo read