From jon at endpoint.com  Sat Feb  9 23:10:31 2019
From: jon at endpoint.com (Jon Jensen)
Date: Sat, 9 Feb 2019 16:10:31 -0700 (MST)
Subject: [TNM] rsyslog timestamp format
Message-ID: <nycvar.YSQ.7.76.1902091603270.8937@ybpnyubfg>

Folks,

I'm using tail_n_mail to watch some syslogs output from rsyslog with this 
format:

2019-02-08T08:16:47.143265-07:00

It is working well enough for me to use this in my config file:

LOG_LINE_PREFIX: \d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d\.\d+\S*\s

I'm wondering if it would make sense to update one of the built-in regexes 
to tolerate this expanded timestamp that has the T separator and the 
timezone offset, e.g. %tb which matches:

(\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d\.\d+)

but could be:

(\d\d\d\d-\d\d-\d\d[ T]\d\d:\d\d:\d\d\.\d+([-+]\d+(:?\d+)?))

and similar in some of the others.

Also, on another note, the website still lists version 1.31.3 as the 
latest, but Git has 2.4.0 now. Should that be updated?

It also says Perl 5.8.3 or newer will work, but since 2017 at the latest, 
tnm has used syntax that works only with 5.14+ so I committed an update to 
the code, and figure we should update the website to match.

Thanks,
Jon


-- 
Jon Jensen
End Point Corporation
https://www.endpoint.com/