テーマ: rfc
-
Timestamped, parseable logs: RFC 5424 versus RFC 3164, JSON templates, and why UTC
RFC 5424's syslog TIMESTAMP is a restricted RFC 3339 profile with year, sub-second precision and a time zone offset, while the earlier RFC 3164 format has none of those and is harder to parse unambiguously. rsyslog can emit either, or a fully custom JSON structure, through templates — and a server whose time zone and logs are in UTC removes an entire class of correlation bugs across time zones.
機械可読: JSON