On Sun, Jul 30, 2000 at 11:06:38PM -0500, Ben Beuchler wrote:
> I understand from DJB's website that TAI is a better way to deal with
> time functions than the typical unix localtime(). However, it seems to
> make a lot of things really awkward when it is used as the time stamp in
> a log file.
Really? If I want to tail a log file, eg, I go like this:
tail ../someservice/current | tai64nlocal
and it all looks fine for humans.
> Any particular idea why DJB chose to use it for output in multilog? It
> seems to me that all it accomplishes is adding extra steps to gleaning
> any useful info from the logs...
Well, there are two issues here. One is the use of that particular
form of timestamp and the granularity of the timestamp. The granularity
of syslog is a second which is no where near good enough for timing
events that occur at sub-second rates. Knowing the author of syslog, I
can guess why he thought that a second was plenty accurate enough for
his MTA. But in the real world of modern computing, events happen
more briefly.
Once you accept that the current mainstream logging system isn't
giving sufficiently useful timestamps, then any change is going to
carry some level of awkwardness. What DjB has done is pick a timestamp
that has some pretty useful characteristics. Importantly, he has chosen
one which is as close to absolute as is possible and one which is
easy to use with date arithmetic.
Regards.
