Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change log timestamp to ISO8601 w/ timezone #518

Merged
merged 4 commits into from Apr 9, 2019

Conversation

Projects
None yet
4 participants
@mstemm
Copy link
Contributor

commented Feb 7, 2019

This prevents ambiguity when, say, running falco in a container, which
may have a different /etc/localtime than the host system.

@daixiang0

This comment has been minimized.

Copy link
Contributor

commented Feb 12, 2019

Fix #527

@mstemm mstemm force-pushed the change-log-timestamp-iso-8601 branch 2 times, most recently from 82acafb to d53191d Feb 13, 2019

@mstemm mstemm requested a review from lorenzo-david Feb 14, 2019

@mfdii

This comment has been minimized.

Copy link
Member

commented Mar 5, 2019

@lorenzo-david can you review for @mstemm

@mstemm

This comment has been minimized.

Copy link
Contributor Author

commented Mar 5, 2019

Actually, this still requires some work before it's ready to review.

@mstemm mstemm force-pushed the change-log-timestamp-iso-8601 branch 2 times, most recently from 92d6be8 to ab4d552 Apr 5, 2019

mstemm added some commits Feb 7, 2019

Add option to display times in ISO 8601 UTC
ISO 8601 time is useful when, say, running falco in a container, which
may have a different /etc/localtime than the host system.

A new config option time_format_iso_8601 controls whether log message
and event times are displayed in ISO 8601 in UTC or in local time. The
default is false (display times in local time).

This option is passed to logger init as well as outputs. For outputs it
eventually changes the time format field from %evt.time/%jevt.time to
%evt.time.iso8601/%jevt.time.iso8601.

Adding this field changes the falco engine version so increment it.

This depends on draios/sysdig#1317.
Unit test for ISO 8601 output
A unit test for ISO 8601 output ensures that both the log and event time
is in ISO 8601 format.
Use ISO 8601 output by default in containers
Now that we have an option that controls iso 8601 output, use it by
default in containers. We do this by changing the value of
time_format_iso_8601 in falco.yaml in the container.

@mstemm mstemm force-pushed the change-log-timestamp-iso-8601 branch from 04d0da8 to c4bc599 Apr 5, 2019

@lorenzo-david
Copy link
Contributor

left a comment

LGTM

Show resolved Hide resolved userspace/falco/logger.cpp Outdated
@lorenzo-david
Copy link
Contributor

left a comment

LGTM

Show resolved Hide resolved userspace/falco/logger.cpp Outdated
Handle errors in strftime/asctime/gmtime
A placeholder "N/A" is used in log messages instead.

@mstemm mstemm merged commit e26a950 into dev Apr 9, 2019

2 checks passed

Travis CI - Branch Build Passed
Details
Travis CI - Pull Request Build Passed
Details

@mstemm mstemm deleted the change-log-timestamp-iso-8601 branch Apr 9, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.