Having a fixed width timestamp would be really nice for parsing, but is not the end of the world if we can't do it.
> YYYY-MM-DDTHH:MM:SS.NNNZ+09:30 If you think about it from a parsing point of view... Assume that you have a message type defined... Type tSyslogMessage Time Date Milliseconds Timezone HostAddress etc End type When you receive a timestamp that has no millisecond count, what do you put in your millisecond variable? If it was me, I'd initialise it with 000. I can see Rainer's point about deciding if a host has an accurate clock or not, but a quick look at the logs would show that every message from that host was stamped with 000 and therefore assume that it was not setting the value. Could we pad it with NNN instead of SP SP SP or 000? >RFC3339 specifies ":" and I see no reason to change things here - let's >stick with the accepted standard (which says fixed size and '+/-'HH:MM). Yes, agreed. Merry Christmas everyone! Andrew Kiwi Enterprises
