[syslog-ng] [Bug 267] New: $YEAR on event in RFC 3164 format

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=267

           Summary: $YEAR on event in RFC 3164 format
           Product: syslog-ng
           Version: 3.3.x
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: unspecified
         Component: syslog-ng
        AssignedTo: bazsi at balabit.hu
        ReportedBy: dtgarry at hotmail.com
Type of the Report: ---
   Estimated Hours: 0.0


I am using syslog-ng 3.3.4 Revision: /3.3.4.dfsg-2ubuntu1 Revision: /3.3.4.dfsg-2ubuntu1

I have a problem on the macro $YEAR when the event is in RFC 3164 format

sometime the $YEAR extract the correct value of year, but not always.

I test this problem on a computer with the current date, 9 january 2014, sending some event with these dates:
- Dec 31 23:59:59, syslog-ng return the 2013 year;
- Jan  1 00:00:01, syslog-ng return the 2014 year;
- Feb  1 00:00:01, syslog-ng return the 2014 year;
- Mar  1 00:00:01, syslog-ng return the 2013 year;

how syslog-ng extract the year from an event when there is no year?

Is it possible to configure correctly the syslog-ng?

for testing I have configured syslog-ng to call my program "mytest" like this:

destination d_tst {
    program("/etc/syslog-ng/sbin/mytest"
    template("<$PRI>$DATE $HOST $PROGRAM $MSGONLY $HOST $FACILITY $PRIORITY $LEVEL $TAG $YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $PROGRAM\n")
    template-escape(yes)
    );
};

on mytest program I log what syslog-ng has parsed;

today, that is the 9th january 2014, I have sent to syslog-ng this string:

<131>Dec 31 23:59:59 hostTest processTest some test
on mytest I will receive:
<131>Dec 31 23:59:59 hostTest processTest some test hostTest local0 err err 83 2013-12-31 23:59:59 processTest
note the year is 2013

If I send this:
<131>Jan  1 00:00:01 hostTest processTest some test
I will receive:
<131>Jan  1 00:00:01 hostTest processTest some test hostTest local0 err err 83 2014-01-01 00:00:01 processTest
now the year is 2014

But I send this event that is in the future:
<131>Feb  1 00:00:01 hostTest processTest some test
I will receive:
<131>Feb  1 00:00:01 hostTest processTest some test hostTest local0 err err 83 2014-02-01 00:00:01 processTest
the year is 2014

If I send an event of march:
<131>Mar  1 00:00:01 hostTest processTest some test
I will receive:
<131>Mar  1 00:00:01 hostTest processTest some test hostTest local0 err err 83 2013-03-01 00:00:01 processTest
where the year is 2013

thank you.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.