logging: add ISO-like timestamp option - v1 #8317
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds a new logging format character, %z that uses a more standard time format of "YYYY-MM-DD HH:MM:SS". Ticket OISF#5764
The default-log-format has changed, reflect this in the suricata.yaml.
Also update suricata.yaml to show this default, as updating the "default-log-format" does not affect the file output.
- Update fragment of configuration file to match suricata.yaml with new default-log-format. - Document new %z format specifier.
jasonish
commented
Dec 22, 2022
Comment on lines
-387
to
+388
| while ( (temp_fmt = strchr(temp_fmt, SC_LOG_FMT_PREFIX)) ) { | ||
| while ((temp_fmt = strchr(temp_fmt, SC_LOG_FMT_PREFIX))) { |
jasonish
commented
Dec 22, 2022
Comment on lines
-591
to
+608
| } | ||
| } |
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #8317 +/- ##
==========================================
+ Coverage 81.83% 81.89% +0.06%
==========================================
Files 963 963
Lines 277131 277310 +179
==========================================
+ Hits 226791 227108 +317
+ Misses 50340 50202 -138
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information:
Pipeline 11284 |
jufajardini
reviewed
Jan 6, 2023
Comment on lines
-1853
to
1861
| t: Time, timestamp, time and date | ||
| example: 15/10/2010 - -11:40:07 | ||
| z: ISO-like formatted timestamp: YYYY-MM-DD HH:MM:SS | ||
| t: Original Suricata log timestamp: DD/MM/YYYY -- HH:MM::SS | ||
| p: Process ID. Suricata's whole processing consists of multiple threads. | ||
| i: Thread ID. ID of individual threads. | ||
| m: Thread module name. (Outputs, Detect etc.) |
There was a problem hiding this comment.
With the recent changes by Victor, I think that this section is missing a few options (D, M, S, T, from what I can see).
jufajardini
reviewed
Jan 6, 2023
Merged
|
Merged in #8360, thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a new log format specifier
%zto use a more ISO-like timestamp formatYYYY-MM-DD HH:MM:SSthat is more commonly used in logs these days.Ticket: https://redmine.openinfosecfoundation.org/issues/5764