And yes, timestamp still follows the standard: https://tools.ietf.org/html/rfc3339#section-5.8
2013/9/13 Rainer Gerhards <[email protected]> > On Fri, Sep 13, 2013 at 12:56 AM, David Lang <[email protected]> wrote: > > > On Thu, 12 Sep 2013, Xuri Nagarin wrote: > > > > Hi David, > >> > >> The logs are from different sources. > >> 1. If the source did not provide millisecond information, shouldn't > >> rsyslog > >> put in "000000" there to keep the format consistent? > >> > > > > > ... and this is done intentionally. Think about this: how do you know that > the ms were indeed "000000" instead of "999999"? Short answer: you don't > know. So if we would pretend we knew, we would remove the capability for > log analysis tools to detect the the time has a certain precision. This is > extremely important if you want to do time-based analysis methods. > > Rainer > > > > No, I don't believe that rsyslog adds trailing zeros to the timestamp, so > > even with milliseconds, the length can vary > > > > > > 2. Are both the time-stamps same in terms of compliance with any time > >> format standards? Or, are they two different standards? > >> > > > > I believe that the standard allows for both formats. > > > > David Lang > > > > > > > >> > >> On Thu, Sep 12, 2013 at 2:28 PM, David Lang <[email protected]> wrote: > >> > >> On Thu, 12 Sep 2013, Xuri Nagarin wrote: > >>> > >>> Hi, > >>> > >>>> > >>>> In the rsyslog config, I use: > >>>> $ActionFileDefaultTemplate RSYSLOG_FileFormat > >>>> > >>>> I noticed that some logs are written with a timestamp that does not > >>>> contain > >>>> millisecond information. Example: > >>>> 2013-09-12T18:34:00+00:00 > >>>> > >>>> Other events are written with millisecond information on the same > >>>> instance > >>>> of rsyslog: > >>>> 2013-08-30T10:09:52.819709+00:****00 > >>>> > >>>> What could be causing this difference? > >>>> > >>>> > >>> are the logs with the different timestamps originating from different > >>> servers? if so, it's probably a matter of the other servers not > providing > >>> the millisecond information. > >>> > >>> If the logs are all from the same machine, are the different logs from > >>> different applications? > >>> > >>> David Lang > >>> ______________________________****_________________ > >>> rsyslog mailing list > >>> http://lists.adiscon.net/****mailman/listinfo/rsyslog< > http://lists.adiscon.net/**mailman/listinfo/rsyslog> > >>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > >>> > > >>> http://www.rsyslog.com/****professional-services/< > http://www.rsyslog.com/**professional-services/> > >>> <http://**www.rsyslog.com/professional-**services/< > http://www.rsyslog.com/professional-services/> > >>> > > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >>> DON'T LIKE THAT. > >>> > >>> ______________________________**_________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/**mailman/listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > >> http://www.rsyslog.com/**professional-services/< > http://www.rsyslog.com/professional-services/> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > >> ______________________________**_________________ > > rsyslog mailing list > > http://lists.adiscon.net/**mailman/listinfo/rsyslog< > http://lists.adiscon.net/mailman/listinfo/rsyslog> > > http://www.rsyslog.com/**professional-services/< > http://www.rsyslog.com/professional-services/> > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
