[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140201120123.598c020a@mopad>
Date: Sat, 1 Feb 2014 12:01:23 +0100
From: Christian Wiese <chris@...nsde.net>
To: musl@...ts.openwall.com
Subject: Re: syslog() always sends GMT timestamps
On Sat, 1 Feb 2014 10:09:14 +0100
Szabolcs Nagy <nsz@...t70.net> wrote:
> * Laurent Bercot <ska-dietlibc@...rnet.org> [2014-01-31 17:26:23
> -0800]:
> > As for timestamps, well, the right format to write them in is
> > obviously neither UTC nor local time, but TAI64N. :)
>
> yes there is nothing clearer than a 24 digit hexadecimal number
> representing time to the nanosecond
>
> at least the last 3-4 digits in the log can be used as a random
> sequence
>
> (i've seen this in practice and have no idea how anybody could
> ever think that it's a good idea.. must be some sysadmin logic
> that is beyond the reach of average mortals)
Of course the format is not very easy to read for humans but quite
useful for machine processing, which is much more important imo because
you will barely have an humanoid sitting there in front of the screen
and looking for suspicious log entries.
If a human needs to look at logs with TAI64N time stamps he/she is
supposed to pipe the the log through a filter like 'tai64nlocal' which
simply transforms the time stamp into a human friendly format.
Besides that I think TAI64N time stamps can be quite useful in the case
you need to correlate logs from a lots of hosts that have different
local time settings. Doing this with logs that use local time stamps
will be a task that is nearly impossible imo or at least needs quite
some effort.
Cheers,
Chris
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
