From owner-freebsd-hackers@freebsd.org Sun Apr 1 19:33:58 2018 Return-Path: Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 30C4BF76AC6 for ; Sun, 1 Apr 2018 19:33:58 +0000 (UTC) (envelope-from ed@nuxi.nl) Received: from mail-lf0-x241.google.com (mail-lf0-x241.google.com [IPv6:2a00:1450:4010:c07::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 995937A288 for ; Sun, 1 Apr 2018 19:33:57 +0000 (UTC) (envelope-from ed@nuxi.nl) Received: by mail-lf0-x241.google.com with SMTP id c78-v6so18220015lfh.1 for ; Sun, 01 Apr 2018 12:33:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nuxi-nl.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=iPU7MxA08wctjLm7nCPyNOnmaCnqH/UBY/npTlH6xoA=; b=TatQ81diHjKcbqogvXvXFeBiX0K+kU8/J631Tkz6coEClL6F9G6QckMCYtubfTHzgl /m8/Gp8az1y6K678fTpdLbHciDLZrzGQNyHEYfReh9cBQHX2SbbA6Cw9JRYjTzI+mFGL +izIw3FZjEryJRcyXIju+1I7pYn+PA3sp2QwnYgWygMOD1HmWgERN7y3c+27swjt7vYJ VVeftvaioPKOcVrpilrtPzG2uEJ5Gya0C+KyieIKAfunNy2epBplyAN6SdhJhSgCSYlL fXouA6ejBc3cdx6qPU0Ve7trgWzssydYBjKWN6Wo0cMZ6ubq+Nj5YOJQ5WYPm6BlphtQ o0iQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=iPU7MxA08wctjLm7nCPyNOnmaCnqH/UBY/npTlH6xoA=; b=Et4u1SvRc9RHPg99Y5BBozSNFoaKmum9DLabPwkHpdHt/1snjlutqe2rAegW0zcu3j ECA47f110S2WHcIfRMBX209MmEeSRXLdA//TI1Nd6dkC/LYwce2iQsr4ydYmfP/+mSMs xRxD0K6Il2Wv0KKn/FSW/j0VrjsuMl+aiX+HbIM8Jh02Kme2AOpRt8TtK7kgdp9jJfR6 mKBVlMRzUaBCqshe8FMoSd1Y6h5qNz3R4So7YWRDjjL0bHrpwDTlN/po/ktqGtr98DAd 8+Us0oIVa9FK9nbJCzqZFi58TzoNiNCuGFFkcpxLjKS3odzhRbjtlHIVCTram31vQJoo 5p7g== X-Gm-Message-State: AElRT7HiinPgqlf0EJ38JgzUpRl1IHpfQbeIrkE6xt8XdSNChD7RMP8X jv8memiB6lZOcoIZAyOU6VvMMzzDvcfXYzr5n5tqzQ== X-Google-Smtp-Source: AIpwx4/GaNqmP/U6R/QtFETEIv3GBL6Fu5IqCePf4BZTKJrFBxcdEbLxS0sJZmMpiX7pI3nnW+A3dJ/h1tDbBBQPFFY= X-Received: by 10.46.156.149 with SMTP id x21mr4058558lji.81.1522611235140; Sun, 01 Apr 2018 12:33:55 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a19:e9c2:0:0:0:0:0 with HTTP; Sun, 1 Apr 2018 12:33:24 -0700 (PDT) In-Reply-To: References: From: Ed Schouten Date: Sun, 1 Apr 2018 21:33:24 +0200 Message-ID: Subject: Re: Add option -Z to syslogd(8) to use ISO 8601 timestamps To: Ben Woods Cc: "freebsd-hackers@freebsd.org" Content-Type: text/plain; charset="UTF-8" X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Apr 2018 19:33:58 -0000 Hi Ben, 2018-04-01 2:27 GMT+02:00 Ben Woods : > Hi everyone, > > Please review my patch to add the -Z option to syslogd(8) to use ISO 8601 > timestamps in UTC: > https://reviews.freebsd.org/D14918 > > This patch was taken from OpenBSD, and is the first of many features from > RFC5424 that we should be looking to add to syslogd(8) in FreeBSD. > > BACKGROUND: > I have been centralising my logs lately, and found that they had different > timezones, but the RFC3164 syslog timestamp format does not include the > timezone. The servers had their timezones set to UTC, whilst the > workstations had their timezones set to the local timezone. This made it > difficult to correlate events across machines, as my log analysis tool had > simultaneous events entered with timestamps many hours apart. > > I have added a few people to the review who last touched syslogd(8) - sorry > to those people, just trying to get reviewers :) Wow! That's a coincidence. I actually started working on something in the same area a couple of days ago. One of our customers requires sub-second precision of log entries, which is why I implemented RFC 5424 support for FreeBSD's syslogd a couple of days ago. I sent out a pull request a couple of minutes ago and only noticed your email just now. https://reviews.freebsd.org/D14926 This patch doesn't change the output format of syslogd. It only adds the RFC 5424 parsing and changes the internal model of syslogd to be based on RFC 5424. Changing the output format to use ISO 8601 formatting was planned for a separate change. What are your thoughts on my pull request? If you like it, maybe it makes more sense to land my change first before applying yours? -- Ed Schouten Nuxi, 's-Hertogenbosch, the Netherlands