This looks good - can you send it to me (via private mail is fine) as a file attachment?
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Thursday, November 29, 2012 3:50 PM > To: [email protected] > Subject: [rsyslog] Unix socket with rfc5424 messages > > Hi all, > > following this thread of the forum : > http://kb.monitorware.com/post22948.html#p22948 , would it be possible > to > integrate the following patch in the trunk ? > The only thing it does is to try the RFC3339 timestamp format on top > of the > old one for logs coming through the unix socket. > > Cheers, > > Sebastien > > diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c > index 9e60c9d..c09ae36 100644 > --- a/plugins/imuxsock/imuxsock.c > +++ b/plugins/imuxsock/imuxsock.c > @@ -859,15 +859,19 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, > struct > ucred *cred, struct tim > /* in this case, we still need to find out if > we have > a valid > * datestamp or not .. and advance the parse > pointer > accordingly. > */ > - datetime.ParseTIMESTAMP3164(&dummyTS, &parse, > &lenMsg); > + if (datetime.ParseTIMESTAMP3339(&dummyTS, > &parse, > &lenMsg) != RS_RET_OK) { > + datetime.ParseTIMESTAMP3164(&dummyTS, > &parse, > &lenMsg); > + } > } else { > - if(datetime.ParseTIMESTAMP3164(&(pMsg- > >tTIMESTAMP), > &parse, &lenMsg) != RS_RET_OK) { > + if(datetime.ParseTIMESTAMP3339(&(pMsg- > >tTIMESTAMP), > &parse, &lenMsg) != RS_RET_OK && > + datetime.ParseTIMESTAMP3164(&(pMsg- > >tTIMESTAMP), > &parse, &lenMsg) != RS_RET_OK) { > DBGPRINTF("we have a problem, invalid > timestamp in msg!\n"); > } > } > } else { /* if we pulled the time from the system, we need to > update > the message text */ > uchar *tmpParse = parse; /* just to check correctness > of TS > */ > - if(datetime.ParseTIMESTAMP3164(&dummyTS, &tmpParse, > &lenMsg) > == RS_RET_OK) { > + if(datetime.ParseTIMESTAMP3339(&dummyTS, &tmpParse, > &lenMsg) > == RS_RET_OK || > + datetime.ParseTIMESTAMP3164(&dummyTS, &tmpParse, > &lenMsg) > == RS_RET_OK) { > /* We modify the message only if it contained a > valid > timestamp, > * otherwise we do not touch it at all. */ > datetime.formatTimestamp3164(&st, (char*)parse, > 0); > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
