Hi all,
following this thread of the forum :
http://kb.monitorware.com/post22948.html#p22948 , would it be possible to
integrate the following patch in the trunk ?
The only thing it does is to try the RFC3339 timestamp format on top of the
old one for logs coming through the unix socket.
Cheers,
Sebastien
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index 9e60c9d..c09ae36 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -859,15 +859,19 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct
ucred *cred, struct tim
/* in this case, we still need to find out if we have
a valid
* datestamp or not .. and advance the parse pointer
accordingly.
*/
- datetime.ParseTIMESTAMP3164(&dummyTS, &parse,
&lenMsg);
+ if (datetime.ParseTIMESTAMP3339(&dummyTS, &parse,
&lenMsg) != RS_RET_OK) {
+ datetime.ParseTIMESTAMP3164(&dummyTS, &parse,
&lenMsg);
+ }
} else {
- if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP),
&parse, &lenMsg) != RS_RET_OK) {
+ if(datetime.ParseTIMESTAMP3339(&(pMsg->tTIMESTAMP),
&parse, &lenMsg) != RS_RET_OK &&
+ datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP),
&parse, &lenMsg) != RS_RET_OK) {
DBGPRINTF("we have a problem, invalid
timestamp in msg!\n");
}
}
} else { /* if we pulled the time from the system, we need to update
the message text */
uchar *tmpParse = parse; /* just to check correctness of TS
*/
- if(datetime.ParseTIMESTAMP3164(&dummyTS, &tmpParse, &lenMsg)
== RS_RET_OK) {
+ if(datetime.ParseTIMESTAMP3339(&dummyTS, &tmpParse, &lenMsg)
== RS_RET_OK ||
+ datetime.ParseTIMESTAMP3164(&dummyTS, &tmpParse, &lenMsg)
== RS_RET_OK) {
/* We modify the message only if it contained a valid
timestamp,
* otherwise we do not touch it at all. */
datetime.formatTimestamp3164(&st, (char*)parse, 0);
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
