clone 475303 -1 reassign -1 logcheck retitle -1 Please add support for RFC 3339 high precision timestamps block 475303 -1 thanks
Francois Marier wrote:
> Package: rsyslog
> Version: 3.14.1-1
> Severity: normal
>
> The default timestamp format (high precision) is incompatible with the rules
> that ship
> with logcheck.
>
> For example (/etc/logcheck/ignore.server/local-ssh):
>
> ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ sshd\[[0-9]+\]: Received SIGHUP;
> restarting.$
>
> whereas the date is displayed by rsyslog like:
>
> 2008-04-10T01:34:17.893241+12:00
>
> Now, I realize it might also be considered a logcheck bug, but the trouble is
> that
> rsyslog will break all of the custom rules that people have written.
>
high precision timestamps as defined by RFC 3339 are definitely a
feature of rsyslog, not a bug.
rsyslog by default (as of 3.14.1 and greater) enables high precision
timestamps for local messages but still uses the old format for messages
it sends to other syslog servers (that's a conservative assumption, as
we can't control what software is installed on other systems).
For Debian, I'd like to see all packages, dealing with log files, fixed
to support high precision timestamps.
I thus cloned the bug report for logcheck and made it a blocker bug for
#475303.
I will keep the high precision timestamps enabled, which should help to
identify all affected packages.
In case we can't find and fix all packages for lenny, I can still
disable high precision timestamps prior to release. That's why I keep
this bug open, to track the progress of this issue.
If the logcheck maintainer is concerned that users might have written
incompatible scripts, he can add a note to README.Debian/NEWS.Debian how
they can disable high precision timestamps [1].
Cheers,
Michael
[1] http://www.rsyslog.com/doc-v3compatibility.html , Output File Format
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
signature.asc
Description: OpenPGP digital signature
