# syslog-ng-3.7.2 has broken timestamps (again)

## toralf

Damn, now I'm really annoyed that this issue appears again : 2 different time stamps for the same event in 2 different files: 

```
log # grep SYN *log

kern.log:Nov 20 22:26:29 tor-relay kernel: [2431358.124515] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies.  Check SNMP counters.

syslog:Nov 20 22:02:34 tor-relay kernel: TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies.  Check SNMP counters.

```

/me wonders which logger is worth to switch to it ? After running twice into this mess within 1 year I can't now any longer trust into the Balabit company and their software any longer.

I'm looking especially for a logger which have the capability to grep for patterns and write the matching log entries into dedicated files.Last edited by toralf on Fri Jan 22, 2016 9:13 pm; edited 3 times in total

----------

## Anon-E-moose

syslog-ng does search for patterns.

From my syslog-ng.conf

destination iptables { file("/var/log/firewall" perm(0640)); };

...

filter f_iptables { match("IPTABLES:" value("MESSAGE")); };

...

log { source(src); filter(f_iptables); destination(iptables); };

filter f_messages { level(info..emerg) and not filter (f_iptables) and not filter (f_smartd) and not facility(cron, mail, auth, authpriv); };

----------

## UberLord

To me, it looks like the same event at different times, so it's fine? (From a syslog POV).

For BSD at least, the syslog(3) call is made in libc where the date/time part is formatted before sending to the syslog socket.

If we assume that glibc is the same, then changing the logger will have zero effect.

----------

## toralf

 *UberLord wrote:*   

> To me, it looks like the same event at different times, so it's fine? (From a syslog POV).
> 
> For BSD at least, the syslog(3) call is made in libc where the date/time part is formatted before sending to the syslog socket.
> 
> If we assume that glibc is the same, then changing the logger will have zero effect.

 Well, in this case the timestamps are wrong, upstream confirmed it https://github.com/balabit/syslog-ng/issues/766#issuecomment-158874323

But the origin question is still - which *other* logger fits my needs ?

----------

## toralf

3.7.2 - same mess : http://www.zwiebeltoralf.de/pub/syslog-ng-3.7.2-mess.txt

/me needs a good logger which has filter capabilities

----------

## Syl20

Rsyslog is a little more rustic, but you can set filters too.

----------

