Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug #1441: add timezone to timestamp in JSON logs #1437

Closed
wants to merge 1 commit into from
Closed

Bug #1441: add timezone to timestamp in JSON logs #1437

wants to merge 1 commit into from

Conversation

gozzy
Copy link
Contributor

@gozzy gozzy commented Apr 17, 2015

Fixed #1436 - now should work properly on FreeBSD too.

@maxtors
Copy link
Contributor

maxtors commented Apr 17, 2015

Maybe i saw wrong, but would it not be better if we follow ISO 8601 for the timestamps? Or even possibly allow for different timestamps to be configured?

This would increase the ease for MSSP's to include and implement Suricata as a part of their IDS portfolio. (well a good MSSP would be able to handle a different timeformat, but hey, just generally speaking).

@gozzy
Copy link
Contributor Author

gozzy commented Apr 17, 2015

@maxtors, it seemed to me that this format conforms to ISO-8601. It's possible to make timestamp format configurable, but is there any reason for that? Databases support this format without any problems, and most of log servers/collectors should do the same (especially if they support RFC-5424 - 'new' syslog protocol).

@alessandro-guido changing timezone while suricata is running will cause a mess :) Actually, this code can be moved to CreateIsoTimeString() or called from it, but in this case it'll be better to support tm_gmtoff to avoid overhead. And if gm_gmtoff is not found, use 'legacy' style like proposed one (via ifdefs). In this case it also may be useful to have this feature togglable.

@gozzy
Copy link
Contributor Author

gozzy commented Apr 17, 2015

Replaced with #1439

@gozzy gozzy closed this Apr 17, 2015
@gozzy gozzy deleted the eve_log_timezone2 branch April 17, 2015 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants