Re: [logs] Syslog payload format

Previous message: Mikael Olsson: "Re: [logs] Syslog payload format"
Next in thread: marc: "Re: [logs] Syslog payload format"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

gjbat_private

Bennett Todd wrote:

| What benefit do you see to keeping the broken timestamp format
| around (and yes, I do understand that you propose an additional
| useful timestamp in a separate tag-marked field)?

I may have been asleep when it was discussed last or perhaps my
eyes just glazed over, but I can't see why on earth we're still
talking about formatting timestamps.  Why don't we just log the
timestamp as the number of seconds since the epoch in UTC with
an optional milliseconds part?  This is short, unambiguous, and
very easy to re-format into any display format in any language
for any timezone at the time the log is being examined.  Every
other possibility introduces nightmares for parsing and efforts
to compare timestamps.

Greg
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis