-
Title
Differences Between S, R, and C Within Date Macros -
Description
What are the differences between S, R, and C within date macros such as ISODATE and when does that date macro equal S or R? -
Resolution
The difference between the S, C, and R pertaining to the ISODATE can be found below. Please note, this is not limited to the ISODATE and applies to all other time/date macros as well such as DATE, MIN, SEC, etc...
S_ISODATE = ISODATE derived from the source (sender), stamped to the log when the log was sent from the source (sender). This is not stamped by Syslog-ng.
R_ISODATE = The ISODATE derived from when the log was received at the destination, such as a Syslog-ng relay. This is not stamped by Syslog-ng.
C_ISODATE = The ISODATE from when the macro itself (C_ISODATE) is resolved within Syslog-ng. This is stamped from Syslog-ng itself.i.e. When using C_ISODATE in a destination template such as the following
template("${C_ISODATE} ${HOST} ${MSGHDR} ${MESSAGE}\n")The C_ISODATE is stamped as the time when that macro is called within the template.
If keep-timestamp(yes) is set in the global options, then ISODATE equals S_ISODATE
If keep-timestamp(no) is set in the global options, then ISODATE equals R_ISODATE
NOTE : The keep-timestamp() option defaults to yes, even when not included in the global options.