Postfix log analysis : Date calculation problem

[Wytze van der Raay]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 19.04.2006 09:56, Joost van Baal wrote:
> Op di 18 apr 2006 om 08:29:55 +0200 schreef Stephan Ruggiero:
>>If this is a problem: Is there a way to get around it?
> 
> Well, since syslog doesn't add the year to its timestamps, Lire uses
> some heuristics to guess the year.  There might very well be a bug in
> these heuristics.

I don't think there is a bug in the heuristics (which are indeed in
Lire::Time::syslog2cal()), but you have to keep in mind that they are
*heuristics*, i.e. they assume the "normal" case, processing a logfile
which is fairly recent. More specifically, when running on April 19, 2006,
the heuristic will map a "year-less" date in a logfile of April 21 or later
to the previous year (2005), but will map a year-less date up to April 20
to the current year (2006).  Thus a logfile with dates Jan 1 - Dec 31 will
effectively be interpreted as containing dates April 21, 2005 - April 20, 2006.
As far as I am aware, the only way out of this is to preprocess your
logfile, adding an explicit year to the timestamps.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFERe9Uqs+zhiEbbu8RAlW0AKCE80O0AFfarhVtUbwUWJd/Jb+ULQCfTgeG
E2T+YIU1iglpYFMxdT7JoC0=
=gsx/
-----END PGP SIGNATURE-----

-- 
To UNSUBSCRIBE, email to questions-request at logreport.org with a subject of 
"unsubscribe". Trouble? Send an email with subject "help" to 
questions-request at logreport.org