I'm doing this:
*.* %regex -h 'host.*' %mysql -D -F -P -s ...
Looks like the timestamp logged into the database is
the one sent by the host, not the time on the log server.
I'd like to log using the time of the log server, but
of course making
it optional (either the timestamp provided by the host,
or the time on
the logserver) is even better. ;-)
Logged In: YES
user_id=459912
I have thinking about adding a %time module.
It would be used to munge the timestamp.
In particular the time posted, according to the rfc, is
local time.
Well once these messages start getting shipped around the
meaning of local time changes.
Also, the relevant time may not be the time the message was
created but rather received (this I believe is your point).
The regex module currently has some timestamp munging
capabilty but it has some serious shortcomings so I am
thinking it should be deprecated.