Thanks Flo. Yes, that is the doc page I was looking at. And yes, "now"
is a terrible name for a date stamp and is certainly the cause for my
misunderstanding of how it might be used.
Returning to the original question, is there a way to get a high
resolution RFC3339 representation of current local clock time during
rsyslog event processing?
This can certainly be different from timereported, and if I read the
documentation correctly it can also be different from timegenerated.
Naturally the local clock time when the message is processed shouldn't
be much different from when the message was received, but comparing the
delta over time can be useful as an indication of application or system
performance.
Regards,
On 11/28/18 9:48 AM, Flo Rance via rsyslog wrote:
$now is documented here:
https://www.rsyslog.com/doc/master/configuration/properties.html
It's a date, not a timestamp. It may be a misunderstanding.
On Wed, Nov 28, 2018 at 4:31 PM John Chivian <[email protected]> wrote:
Thanks, but this does not answer the question. I am interested in $now,
not timereported.
On 11/28/18 9:07 AM, Joe Blow via rsyslog wrote:
you can always cut the values out of the times yourself:
template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}
On Wed, Nov 28, 2018 at 9:51 AM John Chivian <[email protected]>
wrote:
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second
or
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of
$now,
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any
help!
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
