[syslog-ng] [Bug 267] $YEAR on event in RFC 3164 format

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=267


splintercode <dtgarry at hotmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtgarry at hotmail.com




--- Comment #1 from splintercode <dtgarry at hotmail.com>  2014-01-10 14:35:24 ---
Hello,

I have found on syslog-format.c, from line 385, these codes:

          /* detect if the message is coming from last year. If its
           * month is at least one larger than the current month. This
           * handles both clocks that are in the future, or in the
           * past:
           *   in January we receive a message from December (past) => last year
           *   in January we receive a message from February (future) => same year
           *   in December we receive a message from January (future) => next year
           */
          if (tm.tm_mon > nowtm.tm_mon + 1)
            tm.tm_year--;
          if (tm.tm_mon < nowtm.tm_mon - 1)
            tm.tm_year++;


It seems that these codes is responsible of the strange situation;

But I don't understand why? Is there an RFC referring to this? 

May be the best this code?
if (tm.tm_mon > nowtm.tm_mon + 1) tm.tm_year--;

I think that if the date of the event is over the current date, this means that this is an event of the past year, not of the future.

May be the best to add a new parameter on syslog-ng.conf to configure this situation.

What do you think about?

Thank you.



-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.