Hi, Thanks for the reply.
I had found these issues: https://github.com/rsyslog/rsyslog/issues/3329 (Enhancement to $now property) https://github.com/rsyslog/rsyslog/issues/3930 (Properties timegenerated and timereported are not high precision in the RainerScript context) For our use we are looking for something with second granularity, and in UTC. $timegenerated has second granularity, but there is no $timegenerated-utc available. $now and $now-utc both only have granularity to the day. A simple example of the use case for the property in a rules might be: # Get Unix timestamp of current message set $.tnow = parse_time($timegenerated); # Rate limit info to 5 every 60 seconds if ($!severity == 6 and $!facility == 17) then { if (($.tnow - $/trate) > 60) then { # 5 seconds window expired, allow more messages set $/trate = $.tnow; set $/ratecount = 0; } if ($/ratecount > 5) then { # discard message stop } else { set $/ratecount = $/ratecount + 1; } } Would it be possible to add a $timegenerated-utc property? Any pointers into the rsyslog code on where this might be implemented would be welcome, and we could take a look. Thanks, Nick On Mon, 2 Nov 2020 at 20:59, John Chivian via rsyslog < [email protected]> wrote: > Time. What is time anyway? The easiest way to solve your problem is to > punt and log everything in high resolution UTC. Or you could log > everything with high resolution local time (including TZ offset). Or you > could set your entire logging infrastructure use UTC only. At least > then you wouldn't have the problem of the wobbling hour. > > All that aside, there is already an enhancement request for a high > resolution $now but it's a low priority item with not much momentum. > Such a thing would return server local time regardless of the timezone > setting on the server (which would of course be UTC). > > The current $now (as you've discovered) is a low resolution string, not > an actual timestamp that can be cast with a format. > > Regards, > > > On 11/2/20 12:14 PM, Nicholas Brown via rsyslog wrote: > > Hi, > > > > I'm looking for a useful monatomic timestamp property that can be used > for > > rate-limiting calculations in rules. > > > > 'parse_time($timegenerated)' mostly works, but when there are local time > > adjustments happen like daylight saving and time goes backwards. > > > > > https://www.rsyslog.com/doc/master/configuration/properties.html#system-properties > > > https://www.rsyslog.com/doc/master/rainerscript/functions/rs-parse_time.html > > > > A $timegenerated-utc property would not have daylight saving timezone > > issues, but does not appear to be available. Similar $now-utc is > available, > > but it does not have second resolution to be useful to convert to a unix > > timestamp with parse_time(). > > > > Is there a high precision utc timestamp property available? > > > > Thanks, > > Nick > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
