Re: Syslog date/time format

From: Jamie Lawrence (jal@abulafia.com)
Date: 12/05/01 

Date: Wed, 05 Dec 2001 13:51:48 -0800
To: focus-sun@securityfocus.com
From: Jamie Lawrence <jal@abulafia.com>

>>for log entries. I'm currently looking at modifying the syslogd code to
>>allow for a switch that would allow the log program to use GMT/UTC time
>>instead of the local time.
>>First, is this the right approach to use in changing syslogd?
>
>
>I would say the correct approach is to request that Sun enhance syslogd
>to provide this functionality - the normal way to do that is for the
>customer to call Sun Enterprise Services or their Sales rep and ask for
>an RFE to be logged, this means it will be considered for a future
>release.

If Sun Support is vital to you, I would suggest writing a script to
forward logged events to you. Shouldn't be too painful, but still not
pleasant.

If you're willing to make trivial modifications, there are a number of
ways to fix this without waiting for Sun to modify suslogd.

>>Third, it seems that the change should be from using the ctime() call in
>>syslogd to using a combination of gmtime() and asctime(). Would this be
>>correct?
>
>
>That would be one way of doing it.
>
>A much simpler way would be setting the TZ variable to GMT before
>syslogd is started. You could do that by editing the /etc/init.d/syslog
>startup script - of course that would be unsupported by Sun but so
>would a modified from source syslogd. This method is much less risk.

Frankly, this is exactly how I'd do it. Switch it back before you call Sun
for a problem, make sure it is still a problem, and call Sun.

Unless, of course, you have policy in place preventing such actions.

-j

Relevant Pages

  • Re: Computer
    ... On Sun, 25 Jul 2004, Tomas Randa wrote: ... If your system passes this output to syslogd, as Bjoern said, it is not ...
    (freebsd-current)
  • Re: jail on -current and syslogd
    ... On Sun, 20 Jun 2004, Kim Culhan wrote: ... > Starting syslogd. ... To unsubscribe, ...
    (freebsd-current)
  • Re: Force 100 Full Duplex (V210)
    ... Auto-negotiation works well with current Sun and Cisco hardware. ... the original Catalyst 5000 switch cards did not support ...
    (comp.unix.solaris)
  • Re: Force 100 Full Duplex (V210)
    ... I'll comment as the administrator of a large number of Cisco switches ... Auto-negotiation works well with current Sun and Cisco hardware. ... the original Catalyst 5000 switch cards did not support ...
    (comp.unix.solaris)
  • Re: bad ethernet controller on sparc10 question
    ... On Sun, 1 Oct 2006, Arthur Wouk wrote: ... i test the cable and switch combination ... by moving the cable betweenm the ss10 and another fucntioning sun ...
    (comp.sys.sun.hardware)