We have several log sources which omit the optional ":" separator in
the
timezone. We've developed the attached patch to improve Rsyslog's
support for valid RFC-3339 timezones.
--Scott
What are the sources of the problem logs? if they are a common enough
vendor, it may be worth the risk of misparsing messages to deal with
this vendor.
My gut reaction is that not requiring the : isn't likely to misparse
many logs that are otherwise parsed.
David Lang
The biggest offenders are software that uses Log::Syslog::Fast from
CPAN, or naively use POSIX's strftime to format the timestamp. The POSIX
spec specifies HHMM format for timezones, and provides no support for
outputting HH and MM separately.
--Scott
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
