On Wed, Feb 21, 2024 at 02:52:33PM +0100, Ralf Schlatterbeck wrote: > > I forgot to mention: > There is an upstream (rsyslog) bug-report at > https://github.com/rsyslog/rsyslog/issues/5332
Upstream has decided that it is not a bug and that both timestamp formats are valid RFC 3339 (I've checked, the grammar explicitly defines the sub-seconds part of the timestamp as optional). See link above. They also think, logcheck should cope with both formats. So I guess that logcheck should be prepared to receive both kinds of timestamps, the 32-byte version and the 25-byte version (without the subseconds timestamp). In the downstream bug-report of rsylogd (which I suppose will be closed soon) I've mentioned how to configure remote clients to send a timestamp *with* sub-seconds part. See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064385 But there may be other clients out there (which may not be rsyslogd) which still send the traditional format and thus will be logged without a subseconds part. So logcheck should be prepared to receive both formats. Thanks Ralf -- Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16 Open Source Consulting www: www.runtux.com Reichergasse 131, A-3411 Weidling email: [email protected]
