[syslog-ng] [Bug 267] $YEAR on event in RFC 3164 format

[bugzilla at bugzilla.balabit.com]

https://bugzilla.balabit.com/show_bug.cgi?id=267





--- Comment #4 from Balazs Scheidler <bazsi at balabit.hu>  2014-01-24 09:38:26 ---
Thanks for the suggestion. My issue with only leaving a single day as gap to determine if it was 
coming from the past year is that sometimes logs get delayed and sitting in a buffer somewhere.

That can cause longer delays and 1 day is a stretch for sure, but it does happen.

Also, I think we can safely assume that the client is sending logs from the current year, except 
when the log being sent is close to the beginning/end of the year, in which case differences in clocks
can cause incorrectly recognized timestamps.

The thinking behind the other suggestion was, that if a timestamp would be too much in the future, 
it is instead assumed to be in the past instead.


-- 
Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.