Support for RFC3164 with high-precision timestamps

[moll]

Hey,

It'd be nice to get support for the same RFC 3164 format, but with high-precision timestamps that Rsyslog can output. :-)

A line would like the following:

<15>2014-03-14T03:03:01.219558+02:00 host user: test 123

Thanks for the sharing your code, too!

[squeeks]

Thank you for bringing up this and the other two issues. RFC5424 and RFC3339 doesn't explicitly support this type of date, nor does Javascript's Date() object support < 1ms of resolution so any implementation would either drop data on the floor (which I believe is unacceptable) or doing extensive work to provide the resolution. Furthermore RFC3164 couldn't ever support this as it to is restricted to second level resolution.

I don't work on this code anymore as I no longer have the time with other things occupying my life - so to be quite honest with you unless yourself or someone else makes the time and effort to create a pull request for this and your other bugs, don't expect them to be addressed.

[moll]

Actually RFC 3339 and ISO 8601 do support offsets and fractional seconds in a format called extended format: YYYY-MM-DDThh:mm:ss+hh:mm. But you're right about ISO 8601 times not being in RFC 3164.

Anywho, thanks for responding. As I had a pressing need for this, I implemented a simple RFC 3164 parser with that particular format and released it as SyslogProtocol.js a few days ago. Should I stumble upon RFC 5424/RFC 5848 messages, I might implement those, too, as a learning exercise. :-)

Fortunately JavaScript's Date can read the ISO 8601 extended format and the rounding to sub-millisecond wasn't an issue for me.

[squeeks]

Apologies for the delay however...

Actually RFC 3339 and ISO 8601 do support offsets and fractional seconds in a format called extended format: YYYY-MM-DDThh:mm:ss+hh:mm

This is also incorrect, as was my original statement. From RFC 3339's ABNF:

time-secfrac    = "." 1*DIGIT
time-numoffset  = ("+" / "-") time-hour ":" time-minute
time-offset     = "Z" / time-numoffset
partial-time    = time-hour ":" time-minute ":" time-second
                 [time-secfrac]

Thus a given representation of sub-second time would look like, for example: 2014-04-12T12:34:56.1234 (however I interpret this ABNF representation as "minimum of 1 digit" there could be more resolution). ISO8601 may also appear to support sub-seconds, with either "," or "." as the delimiter between the fraction and second. Glossy thus could support sub-second down to the millisecond for RFC5424 messages, but may have document and ignore any lower resolution immediately. Your quoted statement above appears to confuse timezones, in your example it would represent hours and minutes ahead of UTC.

Despite you figuring out your own solution interim, I'd like to keep this ticket around simply so someone else with time could use it as reference.

N.B: To my defense, sub-second resolution is listed as the only feature of "Rarely Used Options" within the RFC, and I never have personally seen a producer of messages ever generate them.

[squeeks]

Just to confirm: Javascript's Date will destroy the resolution below milliseconds:

> var d = new Date("2014-04-12T12:34:56.1234");
undefined
> d.getMilliseconds();
123

[moll]

This is also incorrect

What is incorrect? I didn't quite catch that.

Your quoted statement above appears to confuse timezones, in your example it would represent hours and minutes ahead of UTC.

I think I copied that from the ISO 8601 2004E doc. But to be pedantic, those are offset, not time zones, as the latter carry more information that mere distance from UTC. :) ISO 8601 seems to just use the same hh:mm letters for offsets. Anyways, they're compulsory.

I never have personally seen a producer of messages ever generate them.

Rsyslog does that quite willingly and in some distros out of the box, I think.

[moll]

Did this get resolved or something, @squeeks? ;-)