> The problem that I have with these solutions is that they require the > syslog daemon to know if the time and timezone on the machine > are valid. > I can't think of any way of doing that.
Actually, I think this is the easy part. Its a trivial solution, but I think it works. I think we can require that a syslog implementation - by default - sets a "I am not sure about my time" flag. This is changed only after the operator configures it to be differently. > I'd would be perfectly happy > with a recomendadtion that the hosts should hove the correct > time/timezone information. However, ultimatly it's the sys admin's > problem if their machines have incorrect time/timezone. And the sys > admin which will suffer for it. > > This isn't meat to trivialize the issue, but I don't think that it's a > problem which we should try to solve in the syslog protocol. You can > only do so much to protect people from them selves. I think this time its worth doing it. I see a real-world issue here. I see a fairly simple solution for most of the part. I am still missing a solution for this in the message. But I begin to recommend that we actually put this "reliable time info" flag in a one-byte header field. Looks ugly, but solves an issue... Rainer
