Date: Sat, 1 Feb 2014 12:01:23 +0100 From: Christian Wiese <chris@...nsde.net> To: musl@...ts.openwall.com Subject: Re: syslog() always sends GMT timestamps On Sat, 1 Feb 2014 10:09:14 +0100 Szabolcs Nagy <nsz@...t70.net> wrote: > * Laurent Bercot <ska-dietlibc@...rnet.org> [2014-01-31 17:26:23 > -0800]: > > As for timestamps, well, the right format to write them in is > > obviously neither UTC nor local time, but TAI64N. :) > > yes there is nothing clearer than a 24 digit hexadecimal number > representing time to the nanosecond > > at least the last 3-4 digits in the log can be used as a random > sequence > > (i've seen this in practice and have no idea how anybody could > ever think that it's a good idea.. must be some sysadmin logic > that is beyond the reach of average mortals) Of course the format is not very easy to read for humans but quite useful for machine processing, which is much more important imo because you will barely have an humanoid sitting there in front of the screen and looking for suspicious log entries. If a human needs to look at logs with TAI64N time stamps he/she is supposed to pipe the the log through a filter like 'tai64nlocal' which simply transforms the time stamp into a human friendly format. Besides that I think TAI64N time stamps can be quite useful in the case you need to correlate logs from a lots of hosts that have different local time settings. Doing this with logs that use local time stamps will be a task that is nearly impossible imo or at least needs quite some effort. Cheers, Chris
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.