Created attachment 376654 [details] emerge --info Hello, Since I used a new stage3 with x32 libraries, app-admin/syslog-ng is storing the time with a strange behavior. For example, syslog-ng is the daemon which write in /var/log/auth.log, and since I am in x32 ABIs, I have a lot of this kind of lines: 126618610-05-10T15:52:37+01:00 tux sshd[5838]: SSH: Server;Ltype: Authname;Remote: ... 37424783-05-10T15:52:44+01:00 tux sshd[5838]: Accepted keyboard-interactive/pam for ... ssh2 37490791-05-10T15:52:44+01:00 tux sshd[5838]: pam_unix(sshd:session): session opened for user ... 41207467-05-10T15:52:44+01:00 tux sshd[5850]: SSH: Server;Ltype: Kex;Remote: ... 14598284-05-10T15:59:00+01:00 tux fcron[5894]: pam_unix(fcron:session): session opened for user root by (uid=0) 14631901-05-10T15:59:02+01:00 tux fcron[5894]: pam_unix(fcron:session): session closed for user root 9155425-05-10T16:00:00+01:00 tux fcron[5898]: pam_unix(fcron:session): session opened for user root by (uid=0) 9211499-05-10T16:00:02+01:00 tux fcron[5898]: pam_unix(fcron:session): session closed for user root For the last line, the date should be 2014-05-06T16:00:02+02:00, so, there is an error both on the year and on the timezone. Even for a same process, the year is changed, I think this is a problem with a linked library. I think syslog-ng in x32 ABIs is the origin of this problem because I store as well messages from kernel (see my configuration file in attachment) through syslog-ng, but the date is stored correctly, and other programs don't have this behavior. syslog-ng in no-multilib profile works correctly concerning this behavior. Expected results: The date should be in RFC3339 format, with the good timezone. Steps to reproduce: 1 Using a stage3 with x32 2 emerging app-admin/syslog-ng Thanks for support.
Created attachment 376656 [details] /etc/syslog-ng/syslog-ng.conf Configuration file for version 3.4
ts_format only applies when the log lines don't already have a timestamp. Are you sure that's the case for the lines from fcron and sshd?
Hello (In reply to Mr. Bones. from comment #2) > ts_format only applies when the log lines don't already have a timestamp. > Are you sure that's the case for the lines from fcron and sshd? Hmm, good question, no, I am not sure, but this strange behaviour is not limited to sshd and fcron, and in fact, this strange behavior happens for message from unix-stream("/dev/log" max-connections(256)); Unlike files handled by syslog-ng, I can see correct lines in file /var/log/syslog.log, like: 2014-05-10T13:00:29+02:00 marvin syslog-ng[3519]: syslog-ng shutting down; version='3.4.7' 2014-05-10T13:01:45+02:00 marvin syslog-ng[4204]: syslog-ng starting up; version='3.4.7' So, I think this is close to the socket which communicate with /dev/log, but I don't know more. I verified the content of fcron's configuration, and I didn't see any option about timestamps in fcron, so I think only syslog-ng put timestamps on them. If you need more informations, don't hesitate to ask. Best regards,
Hello, Any update about this behaviour? Maybe is that related to a bad use of pointer with time? http://lwn.net/Articles/456750/
Hello, The bug is still present on the 3.4.8 version.
reopen if this issue is still present with syslog-ng-3.6.1
Hello, Just a message to say it was NOT fixed in version 3.6.1, the year was still wrong (random numbers, which changed on almost every lines) but the other informations of the timestamp were correct, even the timezone. Now, with this 3.6.2 version, the full timestamp is finally correct. Thanks for support.
