File 0003-imklog-added-klogParseKernelTimestamp-option.patch of Package rsyslog.1232
From 2d560d1bf2db31716458a650e7d9094e0a4597cc Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 21 Nov 2012 13:47:19 +0100
References: bnc#783967
Upstream: merged
Url: http://git.adiscon.com/?p=rsyslog.git;a=commit;h=f040bde7a0454dfbc7def36a288bc70c58d878af
Subject: [PATCH] imklog: added $klogParseKernelTimestamp option
When enabled, kernel message [timestamp] is converted for message time.
Default is to use receive time as in 5.8.x and before, because the clock
used to create the timestamp is not supposed to be as accurate as the
monotonic clock (depends on hardware and kernel) resulting in differences
between kernel and system messages which occurred at same time.
---
doc/imklog.html | 10 +++++++++-
plugins/imklog/bsd.c | 3 +++
plugins/imklog/imklog.c | 3 +++
plugins/imklog/imklog.h | 1 +
4 Dateien geändert, 16 Zeilen hinzugefügt(+), 1 Zeile entfernt(-)
diff --git a/doc/imklog.html b/doc/imklog.html
index 268c661..05292dd 100644
--- a/doc/imklog.html
+++ b/doc/imklog.html
@@ -65,10 +65,18 @@ Linux only, ignored on other platforms (but may be specified)</li>
former klogd -2 option<br>
Linux only, ignored on other platforms (but may be specified)<br style="font-weight: bold;">
</li>
+<li><b>$klogParseKernelTimestamp</b> [on/<b>off</b>]
+If enabled and the kernel creates a timestamp for its log messages, this timestamp will be
+parsed and converted into regular message time instead to use the receive time of the kernel
+message (as in 5.8.x and before). Default is to not parse the kernel timestamp, because the
+clock used by the kernel to create the timestamps is not supposed to be as accurate as the
+monotonic clock required to convert it. Depending on the hardware and kernel, it can result
+in message time differences between kernel and system messages which occurred at same time.
+</li>
<li><b>$klogKeepKernelTimestamp</b> [on/<b>off</b>]
If enabled, this option causes to keep the [timestamp] provided by the kernel at the begin
of in each message rather than to remove it, when it could be parsed and converted into
-local time for use as regular message time.
+local time for use as regular message time. Only used, when $klogParseKernelTimestamp is on.
</li>
</ul>
<b>Caveats/Known Bugs:</b>
diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index ec4110d..0603237 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -85,6 +85,9 @@ submitSyslog(int pri, uchar *buf)
struct timeval tv;
struct timeval *tp = NULL;
+ if(!bParseKernelStamp)
+ goto done;
+
if(buf[3] != '[')
goto done;
DBGPRINTF("imklog: kernel timestamp detected, extracting it\n");
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 563b499..e953651 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -77,6 +77,7 @@ int symbols_twice = 0;
int use_syscall = 0;
int symbol_lookup = 0; /* on recent kernels > 2.6, the kernel does this */
int bPermitNonKernel = 0; /* permit logging of messages not having LOG_KERN facility */
+int bParseKernelStamp = 0; /* if try to parse kernel timestamps for message time */
int bKeepKernelStamp = 0; /* keep the kernel timestamp in the message */
int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */
uchar *pszPath = NULL;
@@ -306,6 +307,7 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a
symfile = NULL;
symbol_lookup = 0;
bPermitNonKernel = 0;
+ bParseKernelStamp = 0;
bKeepKernelStamp = 0;
if(pszPath != NULL) {
free(pszPath);
@@ -334,6 +336,7 @@ CODEmodInit_QueryRegCFSLineHdlr
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogpermitnonkernelfacility", 0, eCmdHdlrBinary, NULL, &bPermitNonKernel, STD_LOADABLE_MODULE_ID));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogconsoleloglevel", 0, eCmdHdlrInt, NULL, &console_log_level, STD_LOADABLE_MODULE_ID));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility, NULL, &iFacilIntMsg, STD_LOADABLE_MODULE_ID));
+ CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogparsekerneltimestamp", 0, eCmdHdlrBinary, NULL, &bParseKernelStamp, STD_LOADABLE_MODULE_ID));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogkeepkerneltimestamp", 0, eCmdHdlrBinary, NULL, &bKeepKernelStamp, STD_LOADABLE_MODULE_ID));
CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID));
ENDmodInit
diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h
index 03fb973..c93a53b 100644
--- a/plugins/imklog/imklog.h
+++ b/plugins/imklog/imklog.h
@@ -52,6 +52,7 @@ extern char *symfile;
extern int console_log_level;
extern int dbgPrintSymbols;
extern uchar *pszPath;
+extern int bParseKernelStamp;
extern int bKeepKernelStamp;
/* the functions below may be called by the drivers */
--
1.7.10.4
