分类： LINUX
2008-03-03 21:23:08
The syslog-ng application supports messages originating from different timezones. The original syslog protocol does not include timezone information, but syslog-ng provides a solution by extending the syslog protocol to include the timezone in the log messages. The syslog-ng application also enables administrators to supply timezone information for legacy devices which do not support the protocol extension.
# 注释 ：syslog-ng 应用程序支持来自不同时区的消息。原始的 syslog 协议不支持时区信息，但 syslog-ng 提供了一种手段，用于在日志消息中包含时区信息。
# syslog-ng 同样允许管理员手工提供时区信息。
Timezone information is associated with messages entering syslog-ng is selected using the following algorithm:
# 注释 ：syslog-ng 通过下面两种算法来获得时区信息 ：
# -）1、发送消息的应用程序或者主机指定时区信息，否则使用本地时区
# -）2、在 source driver 中定义 time_zone（）参数。它覆盖消息中的时区信息。每个 source 的默认时区都等于全局的 time_zone（）参数
# -）3、在 destination driver 中定义 time_zone（）参数。
# -）4、如果都没有，则消息不会被改动
# -）5、当 macro 表达式用于目标文件名时，默认使用本地时区
The sender application or host specifies (e.g., the syslog-ng client) the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed.
Specify the parameter for the source driver that reads the message. This parameter overrides the original timezone of the message. Each source defaults to the value of the global option.
Specify the timezone in the destination driver using the parameter. Each destination driver might have an associated timezone value; syslog-ng converts message timestamps to this timezone before sending the message to its destination (file or network socket). Each destination defaults to the value of the global option.
![[Note]](185_files/note%5B1%5D.png) |
Note |
|---|---|
|
A message can be sent to multiple destination zones. The syslog-ng application converts the timezone information properly for every individual destination zone. |
If the timezone is not specified, the message is left unchanged.
When macro expansions are used in the destination filenames, the local timezone is used.
