imklog: added $klogParseKernelTimestamp option

When enabled, kernel message [timestamp] is converted for message time.
Default is to use receive time as in 5.8.x and before, because the clock
used to create the timestamp is not supposed to be as accurate as the
monotonic clock (depends on hardware and kernel) resulting in differences
between kernel and system messages which occurred at same time.

4 files changed, 16 insertions, 1 deletions

diff --git a/doc/imklog.html b/doc/imklog.html
index 268c661a..05292ddf 100644
--- a/doc/imklog.html
+++ b/doc/imklog.html
@@ -65,10 +65,18 @@ Linux only, ignored on other platforms (but may be specified)</li>
 former klogd -2 option<br>
 Linux only, ignored on other platforms (but may be specified)<br style="font-weight: bold;">
 </li>
+<li><b>$klogParseKernelTimestamp</b> [on/<b>off</b>]
+If enabled and the kernel creates a timestamp for its log messages, this timestamp will be
+parsed and converted into regular message time instead to use the receive time of the kernel
+message (as in 5.8.x and before). Default is to not parse the kernel timestamp, because the
+clock used by the kernel to create the timestamps is not supposed to be as accurate as the
+monotonic clock required to convert it. Depending on the hardware and kernel, it can result
+in message time differences between kernel and system messages which occurred at same time.
+</li>
 <li><b>$klogKeepKernelTimestamp</b> [on/<b>off</b>]
 If enabled, this option causes to keep the [timestamp] provided by the kernel at the begin
 of in each message rather than to remove it, when it could be parsed and converted into
-local time for use as regular message time.
+local time for use as regular message time. Only used, when $klogParseKernelTimestamp is on.
 </li>
 </ul>
 <b>Caveats/Known Bugs:</b>
diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index ec4110da..06032373 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -85,6 +85,9 @@ submitSyslog(int pri, uchar *buf)
 	struct timeval tv;
 	struct timeval *tp = NULL;
 
+	if(!bParseKernelStamp)
+		goto done;
+
 	if(buf[3] != '[')
 		goto done;
 	DBGPRINTF("imklog: kernel timestamp detected, extracting it\n");
diff --git a/plugins/imklog/imklog.c b/plugins/imklog/imklog.c
index 563b4994..e9536519 100644
--- a/plugins/imklog/imklog.c
+++ b/plugins/imklog/imklog.c
@@ -77,6 +77,7 @@ int symbols_twice = 0;
 int use_syscall = 0;
 int symbol_lookup = 0; /* on recent kernels > 2.6, the kernel does this */
 int bPermitNonKernel = 0; /* permit logging of messages not having LOG_KERN facility */
+int bParseKernelStamp = 0; /* if try to parse kernel timestamps for message time */
 int bKeepKernelStamp = 0; /* keep the kernel timestamp in the message */
 int iFacilIntMsg; /* the facility to use for internal messages (set by driver) */
 uchar *pszPath = NULL;
@@ -306,6 +307,7 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a
 	symfile = NULL;
 	symbol_lookup = 0;
 	bPermitNonKernel = 0;
+	bParseKernelStamp = 0;
 	bKeepKernelStamp = 0;
 	if(pszPath != NULL) {
 		free(pszPath);
@@ -334,6 +336,7 @@ CODEmodInit_QueryRegCFSLineHdlr
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogpermitnonkernelfacility", 0, eCmdHdlrBinary, NULL, &bPermitNonKernel, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogconsoleloglevel", 0, eCmdHdlrInt, NULL, &console_log_level, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"kloginternalmsgfacility", 0, eCmdHdlrFacility, NULL, &iFacilIntMsg, STD_LOADABLE_MODULE_ID));
+	CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogparsekerneltimestamp", 0, eCmdHdlrBinary, NULL, &bParseKernelStamp, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"klogkeepkerneltimestamp", 0, eCmdHdlrBinary, NULL, &bKeepKernelStamp, STD_LOADABLE_MODULE_ID));
 	CHKiRet(omsdRegCFSLineHdlr((uchar *)"resetconfigvariables", 1, eCmdHdlrCustomHandler, resetConfigVariables, NULL, STD_LOADABLE_MODULE_ID));
 ENDmodInit
diff --git a/plugins/imklog/imklog.h b/plugins/imklog/imklog.h
index 03fb9735..c93a53b5 100644
--- a/plugins/imklog/imklog.h
+++ b/plugins/imklog/imklog.h
@@ -52,6 +52,7 @@ extern char *symfile;
 extern int console_log_level;
 extern int dbgPrintSymbols;
 extern uchar *pszPath;
+extern int bParseKernelStamp;
 extern int bKeepKernelStamp;
 
 /* the functions below may be called by the drivers */