Change log timestamp to ISO8601 w/ timezone #518
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Fix #527 |
mstemm
force-pushed
the
change-log-timestamp-iso-8601
branch
2 times, most recently
from
82acafb
to
d53191d
Compare
|
@lorenzo-david can you review for @mstemm |
|
Actually, this still requires some work before it's ready to review. |
mstemm
force-pushed
the
change-log-timestamp-iso-8601
branch
2 times, most recently
from
92d6be8
to
ab4d552
Compare
ISO 8601 time is useful when, say, running falco in a container, which may have a different /etc/localtime than the host system. A new config option time_format_iso_8601 controls whether log message and event times are displayed in ISO 8601 in UTC or in local time. The default is false (display times in local time). This option is passed to logger init as well as outputs. For outputs it eventually changes the time format field from %evt.time/%jevt.time to %evt.time.iso8601/%jevt.time.iso8601. Adding this field changes the falco engine version so increment it. This depends on draios/sysdig#1317.
A unit test for ISO 8601 output ensures that both the log and event time is in ISO 8601 format.
Now that we have an option that controls iso 8601 output, use it by default in containers. We do this by changing the value of time_format_iso_8601 in falco.yaml in the container.
mstemm
force-pushed
the
change-log-timestamp-iso-8601
branch
from
04d0da8
to
c4bc599
Compare
A placeholder "N/A" is used in log messages instead.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This prevents ambiguity when, say, running falco in a container, which
may have a different /etc/localtime than the host system.