> [...] Given that the time of the event is usually what we care
> about, is the receiving time at D important ?
It might be, but I consider this an implementation detail of the
server, not part of any protocol that might be used. In our case,
back in the 80's we had an issue because we had no clock
synchronization at all and we would get log entries dated well into the
past or future. My hack back then was to have syslogd on our log
server write its own timestamp at the beginning of each line it output
to the log file. It sounds trivial, but this was important to us when
reviewing the logs because it kept things somewhat serial (obviously
propagation delays would skew this, but not by too much, we hoped) and
when tracking problems involving several hosts, this proved to be
quite valuable.
--
Dave Goldberg
Post: The Mitre Corporation\MS B325\202 Burlington Rd.\Bedford, MA 01730
Phone: 781-271-3887
Email: [EMAIL PROTECTED]
