From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from wopr.sciops.net ([216.126.196.60]) by ur; Wed Feb 10 11:06:16 EST 2016 Received: (qmail 1294 invoked by uid 1001); 10 Feb 2016 16:06:12 -0000 Date: Wed, 10 Feb 2016 11:06:12 -0500 From: Kurt H Maier To: 9front@9front.org Subject: Re: [9front] syslog(2) change Message-ID: <20160210160612.GA1282@wopr.sciops.net> Mail-Followup-To: 9front@9front.org References: <1270b9585a3e327733049d87e8a08103@utsuho.znet> <50a1e90923c69e7c710766ab431c23a8@utsuho.znet> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50a1e90923c69e7c710766ab431c23a8@utsuho.znet> List-ID: <9front.9front.org> List-Help: X-Glyph: ➈ X-Bullshit: API-aware DOM-based out-scaling high-performance solution On Wed, Feb 10, 2016 at 07:14:05AM -0500, BurnZeZ@feline.systems wrote: > > This doesn't address the timezone problem, which is arguably the > biggest concern. The first thing I thought of was simply including > the timezone, but that really just means more crap on each line > It's not a concern at all, because (unless you ruin your logging) you have the hostname in the first spot, and you can just look up its timezone. I'm always in support of using epoch time in place of human-readable strings -- or at least ISO-8601 format; either one is sortable. But worrying about timezones is a waste of the actual time. > Another way is to just imply GMT and exclude specifying it in the > date/time, but then the logs don't appear different, so it's not easy > to tell when the behavior was corrected if you're looking back at your > logs in the future. This is trivially solvable by correcting previous logs when you change the damn timezone. You can make all kinds of assumptions about data if you exert the smallest amount of effort into curating it. I also don't know why you want to play three-card-monte with the ordering of the information; the hostname needs to stay first. This makes tools like xcat's xcoll much easier to port and maintain. khm