On Wed, 5 Aug 2020, Rainer Gerhards wrote:
El mié., 5 ago. 2020 a las 8:22, David Lang via rsyslog
(<[email protected]>) escribió:
if I do
set $!trusted!timestamp=$timegenerated;
what I get is a low precision formatted timestamp
if I then try to send this to a remote machine, $!trusted!timestamp contains
something like "Aug 4 20:00:01" so there is no ability to reformat the data an
get a high precision timestamp
is there any way to send a timestamp in a variable that can be formatted as
either a high or low precision string on the receiving end?
Not at the moment. IIRC (pretty sure), it requires considerate
refactoring, as we do not have native date type support inside the
variable/scripting subsystem. That said, we could possibly think about
a function to convert a date string to a unix timestamp and then work
on that one. Unfortunately, we lose the high precision part in that
process. To work around that, we could carry it around as a second
subsecond-only timestamp. It's all not very intuitive, unfortunately.
Not sure if it is worth the effort.
yeah, I thought about using parse_time() but it looses the precision, could we
have a variation (or flag) for parse_time/format_time that is higher precision?
It would be far less of an effort to enhance the functions (or add new ones)
than to modify the core of rsyslog to track timestamps in two ways (which still
leaves the problem of how to send them)
other software I deal with does this is two ways
1. <epoc>.<subsecond>
2. <epoc><nanoseconds>
personally I prefer the first option, but journald does the second (so having a
format_time that handles the journald format would be a good thing in any case)
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
