On Mon, 23 Nov 2015, Dov Murik wrote:
Hi Rainer,
Thanks for the quick response.
On 23 November 2015 at 15:55, Rainer Gerhards <[email protected]> wrote:
Yeah it's probably not supported. I never thought an app could not obtain
time. What is the use case?
We're considering using syslog format for messages from "things"
(small low-power devices), and would like not to rely on their
real-world clocks (some of them might not have a real-world clock at
all).
they still have a clock, it just may not be synced with the real-world.
Note that rsyslog has both the timestamp from the message, and the timereceived
on the server. If you are getting data from a source with a known-bad clock,
make use of timereceived.
But since logs can be delayed in processing, it's actually better to record the
timestamp from the log message even if you are using timereceived for the
wall-clock time. It gives you better information about what's going on in the
sending system
Also note that RFC5424 and it's structured data approach has ended up being a
dud in practice. In practice, it's better to send your log data structured as
JSON in the body of the message. The only advantage of RFC5424 is the timestamp
in the message (high precision with timezone and year)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
