On Tue, Oct 25, 2011 at 02:54:36PM +0300, Mihai Stan wrote: Hi Mihai,
> Here's the unified format patch, hope it's OK now. Yes, that's great. Thanks. Unfortunately it doesn't solve the problem at hand. I'm not sure what your timestamps look like but mine with rsyslog and $ActionFileDefaultTemplate RSYSLOG_FileFormat look like this: 2011-11-20T14:50:03.330603+01:00 debian postfix/pickup[925]: 4B07D7611F: uid=0 from=<root> 2011-11-20T14:50:03.368951+01:00 debian postfix/cleanup[2052]: 4B07D7611F: message-id=<[email protected]> 2011-11-20T14:50:03.378745+01:00 debian postfix/qmgr[927]: 4B07D7611F: from=<[email protected]>, size=275, nrcpt=1 (queue active) 2011-11-20T14:50:03.515416+01:00 debian postfix/local[2055]: 4B07D7611F: to=<[email protected]>, orig_to=<sven>, relay=local, delay=0.26, delays=0.12/0.06/0/0.08, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION") 2011-11-20T14:50:03.516821+01:00 debian postfix/qmgr[927]: 4B07D7611F: removed The currently implemented pattern seems to be not prepared for the fractions of seconds. As far as I remember it was prepared with the syslog-ng ts_format(rfc33390); format, which looks like this: 2011-11-20T15:08:33+01:00 debian postfix/cleanup[2410]: AF3CF76120: message-id=<[email protected]> 2011-11-20T15:08:33+01:00 debian postfix/qmgr[927]: AF3CF76120: from=<[email protected]>, size=275, nrcpt=1 (queue active) 2011-11-20T15:08:33+01:00 debian postfix/local[2412]: AF3CF76120: to=<[email protected]>, orig_to=<sven>, relay=local, delay=0.13, delays=0.07/0.03/0/0.03, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION") 2011-11-20T15:08:33+01:00 debian postfix/qmgr[927]: AF3CF76120: removed Sven -- And I don't know much, but I do know this: With a golden heart comes a rebel fist. [ Streetlight Manifesto - Here's To Life ] -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
