Date: Sun, 1 Apr 2018 21:33:24 +0200 From: Ed Schouten <ed@nuxi.nl> To: Ben Woods <woodsb02@gmail.com> Cc: "freebsd-hackers@freebsd.org" <freebsd-hackers@freebsd.org> Subject: Re: Add option -Z to syslogd(8) to use ISO 8601 timestamps Message-ID: <CABh_MKkwQwry6Sq4bJfqn8r1pejjXsqggtyv7cBFjd4AGL8n=w@mail.gmail.com> In-Reply-To: <CAOc73CCzOoiq9YVC5DJgODC7yF21LCxNXR7aNfKc2FemGOR2cA@mail.gmail.com> References: <CAOc73CCzOoiq9YVC5DJgODC7yF21LCxNXR7aNfKc2FemGOR2cA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Ben, 2018-04-01 2:27 GMT+02:00 Ben Woods <woodsb02@gmail.com>: > Hi everyone, > > Please review my patch to add the -Z option to syslogd(8) to use ISO 8601 > timestamps in UTC: > https://reviews.freebsd.org/D14918 > > This patch was taken from OpenBSD, and is the first of many features from > RFC5424 that we should be looking to add to syslogd(8) in FreeBSD. > > BACKGROUND: > I have been centralising my logs lately, and found that they had different > timezones, but the RFC3164 syslog timestamp format does not include the > timezone. The servers had their timezones set to UTC, whilst the > workstations had their timezones set to the local timezone. This made it > difficult to correlate events across machines, as my log analysis tool had > simultaneous events entered with timestamps many hours apart. > > I have added a few people to the review who last touched syslogd(8) - sorry > to those people, just trying to get reviewers :) Wow! That's a coincidence. I actually started working on something in the same area a couple of days ago. One of our customers requires sub-second precision of log entries, which is why I implemented RFC 5424 support for FreeBSD's syslogd a couple of days ago. I sent out a pull request a couple of minutes ago and only noticed your email just now. https://reviews.freebsd.org/D14926 This patch doesn't change the output format of syslogd. It only adds the RFC 5424 parsing and changes the internal model of syslogd to be based on RFC 5424. Changing the output format to use ISO 8601 formatting was planned for a separate change. What are your thoughts on my pull request? If you like it, maybe it makes more sense to land my change first before applying yours? -- Ed Schouten <ed@nuxi.nl> Nuxi, 's-Hertogenbosch, the Netherlands
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CABh_MKkwQwry6Sq4bJfqn8r1pejjXsqggtyv7cBFjd4AGL8n=w>