[rsyslog] Now

[John Chivian]

Hello Experts.

   I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.

   I was also surprised to find there doesn't appear to be a $second or
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.

   What I want to do is put together an RFC3339 representation of $now,
and I specifically do not want $timegenerated or $timereported.

   Have I missed something fundamental?  Thanks in advance for any help!

Regards, John

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEAS

[Joe Blow via rsyslog]

you can always cut the values out of the times yourself:

template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second or
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of $now,
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any help!
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[John Chivian]

Thanks, but this does not answer the question.  I am interested in $now,
not timereported.

Post by Joe Blow via rsyslog
template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second or
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of $now,
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any help!
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if

[Joe Blow via rsyslog]

Apologies... i misread. I'm stumped as well.

Cheers,

JB

Thanks, but this does not answer the question. I am interested in $now,
not timereported.

Post by Joe Blow via rsyslog
template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second

or

Post by Joe Blow via rsyslog

Post by John Chivian
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of

$now,

Post by Joe Blow via rsyslog

Post by John Chivian
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any

help!

Post by Joe Blow via rsyslog

Post by John Chivian
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad

of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[Flo Rance via rsyslog]

$now is documented here:
https://www.rsyslog.com/doc/master/configuration/properties.html

It's a date, not a timestamp. It may be a misunderstanding.

Thanks, but this does not answer the question. I am interested in $now,
not timereported.

Post by Joe Blow via rsyslog
template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second

or

Post by Joe Blow via rsyslog

Post by John Chivian
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of

$now,

Post by Joe Blow via rsyslog

Post by John Chivian
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any

help!

Post by Joe Blow via rsyslog

Post by John Chivian
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad

of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[John Chivian]

Thanks Flo.  Yes, that is the doc page I was looking at.  And yes, "now"
is a terrible name for a date stamp and is certainly the cause for my
misunderstanding of how it might be used.

Returning to the original question, is there a way to get a high
resolution RFC3339 representation of current local clock time during
rsyslog event processing?

This can certainly be different from timereported, and if I read the
documentation correctly it can also be different from timegenerated. 
Naturally the local clock time when the message is processed shouldn't
be much different from when the message was received, but comparing the
delta over time can be useful as an indication of application or system
performance.

Regards,

Post by Flo Rance via rsyslog
https://www.rsyslog.com/doc/master/configuration/properties.html
It's a date, not a timestamp. It may be a misunderstanding.

Thanks, but this does not answer the question. I am interested in $now,
not timereported.

Post by Joe Blow via rsyslog
template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second

or

Post by Joe Blow via rsyslog

Post by John Chivian
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of

$now,

Post by Joe Blow via rsyslog

Post by John Chivian
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any

help!

Post by Joe Blow via rsyslog

Post by John Chivian
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad

of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBS

[David Lang]

hmm, can someone put in an enhancement request to make $now be a timestamp, but
with a default format of just the date (which is odd, but needed for backwards
compatibility)

with timegenerated and timereported I have never needed to use $now, but I could
see it being wanted for checking for delays between when the message was
recevied and when it was processed (if there were significant queue delays)

David Lang

Date: Wed, 28 Nov 2018 16:48:17 +0100
Subject: Re: [rsyslog] Now
https://www.rsyslog.com/doc/master/configuration/properties.html
It's a date, not a timestamp. It may be a misunderstanding.

Thanks, but this does not answer the question. I am interested in $now,
not timereported.

Post by Joe Blow via rsyslog
template(name="iptables-index"
type="list") {
constant(value="iptables-")
property(name="timereported" dateFormat="rfc3339" position.from="1"
position.to="4")
property(name="timereported" dateFormat="rfc3339" position.from="6"
position.to="7")
property(name="timereported" dateFormat="rfc3339" position.from="9"
position.to="10")
}

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second

or

Post by Joe Blow via rsyslog

Post by John Chivian
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of

$now,

Post by Joe Blow via rsyslog

Post by John Chivian
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any

help!

Post by Joe Blow via rsyslog

Post by John Chivian
Regards, John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad

of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[John Chivian]

Thanks David, it is much appreciated. Being the original instigator of
the discussion I will see if I can figure out how to make the requested
request.

Regards,

Post by David Lang
hmm, can someone put in an enhancement request to make $now be a
timestamp, but with a default format of just the date (which is odd,
but needed for backwards compatibility)
with timegenerated and timereported I have never needed to use $now,
but I could see it being wanted for checking for delays between when
the message was recevied and when it was processed (if there were
significant queue delays)
David Lang

Date: Wed, 28 Nov 2018 16:48:17 +0100
Subject: Re: [rsyslog] Now
https://www.rsyslog.com/doc/master/configuration/properties.html
It's a date, not a timestamp. It may be a misunderstanding.

Post by John Chivian
Hello Experts.
     I was very surprised to find the property $now is only
YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second or
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of $now
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental?  Thanks in advance for any help!
Regards, John

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE an

[Flo Rance via rsyslog]

Hi John,

https://github.com/rsyslog/rsyslog might be a good starting point.

Regards,
Flo

Post by John Chivian
Thanks David, it is much appreciated. Being the original instigator of
the discussion I will see if I can figure out how to make the requested
request.
Regards,

Post by David Lang
hmm, can someone put in an enhancement request to make $now be a
timestamp, but with a default format of just the date (which is odd,
but needed for backwards compatibility)
with timegenerated and timereported I have never needed to use $now,
but I could see it being wanted for checking for delays between when
the message was recevied and when it was processed (if there were
significant queue delays)
David Lang

Date: Wed, 28 Nov 2018 16:48:17 +0100
Subject: Re: [rsyslog] Now
https://www.rsyslog.com/doc/master/configuration/properties.html
It's a date, not a timestamp. It may be a misunderstanding.

Post by John Chivian
Hello Experts.
I was very surprised to find the property $now is only YYYY-MM-DD,
and was not subject to the dateFormat="rfc3339" specifier.
I was also surprised to find there doesn't appear to be a $second or
$microsecond property similar to the $year, $month, $day, $hour, and
$minute properties listed in the documentation.
What I want to do is put together an RFC3339 representation of $now
and I specifically do not want $timegenerated or $timereported.
Have I missed something fundamental? Thanks in advance for any help!
Regards, John

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[John Chivian]

Thank you folks!

Enhancement request #3329 is entered in GitHub.

I'll also start the process of getting documentation update abilities. 
I might be able to make some contributions in that area given the amount
of time I seem to spend in the doc section of the website.

Regards,

Post by Flo Rance via rsyslog
Hi John,
https://github.com/rsyslog/rsyslog might be a good starting point.
Regards,
Flo

Post by John Chivian
Thanks David, it is much appreciated. Being the original instigator of
the discussion I will see if I can figure out how to make the requested
request.
Regards,

Post by David Lang
hmm, can someone put in an enhancement request to make $now be a
timestamp, but with a default format of just the date (which is odd,
but needed for backwards compatibility)
with timegenerated and timereported I have never needed to use $now,
but I could see it being wanted for checking for delays between when
the message was recevied and when it was processed (if there were
significant queue delays)
David Lang

Date: Wed, 28 Nov 2018 16:48:17 +0100
Subject: Re: [rsyslog] Now
https://www.rsyslog.com/doc/master/configuration/properties.html
It's a date, not a timestamp. It may be a misunderstanding.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE T