[syslog-ng] Timezone

[Sebastian Roland]

Hi,

after reading the admin guide and playing around with different setups
several times I'm still struggling to fully understand the timezone
functionality of syslog-ng.

How are time-zone() / recv-time-zone() and send-time-zone() related?

Some notes I made during investigation:

* Logging through syslog() function logs in old BSD syslog format which
does not contain a timezone. recv-time-zone() is utilized to assign a
timezone. If no value has been specified the local time zone is used.
* According to the admin guide send-time-zone() is only used when the
timezone is not specified otherwise. This didn't turned out to be true.

Example:
Syslog server a sends via syslog protocol over tcp (timezone is part of
the message) to server b. setting send-time-zone(x) on server b changes
the timezone (and timestamp) in the destination file to the time in
timezone x.
If send-time-zone() is not set at all nothing happens although the
admin guide states that the default is to use the local timezone. IMHO
no change should be applied to the message. Note that keep-
timestamp(yes) is set on server b.

* If both time-zone() and send-time-zone() are set globally time-zone() 
overrides send-time-zone()

* time-zone() can be set globally and on drivers. Specific settings
overrides global config.


The confusing part is the behavior when a timestamp is already set
within an incoming message and send-time-zone() is explicitly set (with
keep-timestamp(yes)). Is it actually intended that send-time-zone()
changes a timestamp?


Shouldn't the logic be that recv-time-zone() and send-time-zone() are
only relevant when there is no tz offset available and a default one
needs to be set for receiving and sending respectively and time-zone()
is used to actually convert to a different timezone?


If I'm getting something fundamentally wrong please advice.

Kind regards
Sebastian