[syslog-ng] Millisecond Resolution Timestamps

[Evan Rempel]

If you are using the S_* macros then you will get the time stamp that the application places into the log line.
That is usually a time stamp with no subsecond data.

If you use the R_* macros for your date/time then you should get the subsecond resolution.


On 04/15/2014 10:31 AM, David Hauck wrote:
> Hello,
>
> I'm using the following global options in order to format messages with millisecond resolution:
>
>    ts_format(iso);
>    frac_digits(3);
>
> Although the initial (syslog-ng starting) message appears to include sub-second resolution subsequent messages do not:
>
> 20140415 10:19:23.590 notice syslog(syslog-ng):syslog-ng starting up; version='3.5.4.1'
> ...
> 20140415 10:19:33.000 notice authpriv(su):FAILED su for test by root
> ...
> 20140415 10:20:11.000 notice user(root):test
>
> This includes messages originating from any number of sources (including all processes that log via syslog()), *except* messages originating from the kernel (these always seem to have sub-second resolution). Does anyone have any ideas what might be going on here?
>
> Thanks,
> -David
>
> PS: the timestamp formatting above is done via a simple template. Regardless of this (re-)formatting nominal iso messages also exhibit this limitation. For e.g.,:
>
> 2014-04-14T15:23:48.000-07:00 host99738728 nasysconfd: exit code 0 for /netacquire/bin/sysconf/osinfo read
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>


-- 
Evan Rempel                                      erempel at uvic.ca
Senior Systems Administrator                        250.721.7691
Data Centre Services, University Systems, University of Victoria