Hi all,
I got an interesting question from another discussion list.
As you (hopefully) are aware, rsyslog supports high precision
timestamps. However, the default format does not output them in order to
avoid confusing log parsers. That, in turn, leads to few people actually
ever using it. So in the end run, rsyslog's high-precision timestamps
have never been used much in the past 3+ years.
One suggestion to solve the log parser problem was that we should begin
to use the high-precision stamp by default and work with
converters/filters when data is fed to log analysers.
What is your opinion on this topic? Is it time to change the default
output format for timestamps?
Rainer
I got an interesting question from another discussion list.
As you (hopefully) are aware, rsyslog supports high precision
timestamps. However, the default format does not output them in order to
avoid confusing log parsers. That, in turn, leads to few people actually
ever using it. So in the end run, rsyslog's high-precision timestamps
have never been used much in the past 3+ years.
One suggestion to solve the log parser problem was that we should begin
to use the high-precision stamp by default and work with
converters/filters when data is fed to log analysers.
What is your opinion on this topic? Is it time to change the default
output format for timestamps?
Rainer