hi Bill,
as John mentioned, 'write' action does not enforce you to use any timestamp
format. You are probably seeing this issue because you are employing the %t
variable together with 'write'. The action
action=write - %t %s
has been used in quite many examples in this mailing list, and that could
create an impression that %t is rigidly connected to 'write'. In fact, there is
no such connection, and while %t defines a timestamp that begins with a
weekday, you can employ other formats if you like.
The desired format you mentioned ("Sep 1 22:34:57 2010" instead of Wed Sep 1
22:34:57 2010") is quite similar to timestamp format used by syslogd (the only
difference is that syslogd does not write the year into the log). Does that
mean that you are trying to use 'write' action for writing into UNIX syslogd
files, and you want SEC output events have the same format as syslog events? If
so, I'd recommend to use 'logger' (or other utility/function that talks to
syslogd) for that purpose. First, if you don't write to syslogd files directly
but rather hand the event over to syslogd, a common timestamp will be assigned
by local syslogd. Second, writing directly to syslogd files could interfere
with syslogd write actions, and some events could be (partly) overwritten. In
that case, action=pipe logger -p ... -t ... might be a better solution.
If you are trying to write into a separate file and just don't want to see day
of the week for some reason, you could use the following simple but somewhat
crude approach:
action=eval %timestamp (substr("%t",4)); write - %timestamp %s
The 'eval' action will simply extract the relevant part from %t and assign it
to %timestamp variable, which is then used by 'write'.
If you have a large number of events per second to be logged in this way, I'd
recommend to set up a precompiled Perl subroutine for this task.
hope this helps,
risto
> When I use the Write command, the
> date stamp at the front of the event has the day of the week
> as the leading element. My normal events do not.
> Is there a way to reformat the time used by Write to
> eliminate the leading day of week entry?
>
> Thanks,
> Bill
>
>
> ------------------------------------------------------------------------------
> This SF.net Dev2Dev email is sponsored by:
>
> Show off your parallel programming skills.
> Enter the Intel(R) Threading Challenge 2010.
> http://p.sf.net/sfu/intel-thread-sfd
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
This SF.net Dev2Dev email is sponsored by:
Show off your parallel programming skills.
Enter the Intel(R) Threading Challenge 2010.
http://p.sf.net/sfu/intel-thread-sfd
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
