From 318a6fb577a6e5af558b70232bb0a19871399d13 Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 21 Nov 2012 13:46:58 +0100
Subject: imklog: added $klogKeepKernelTimestamp option

When enabled, the kernel [timestamp] remains at begin of
each message, even it is used for the message time too.
---
 plugins/imklog/bsd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'plugins/imklog/bsd.c')

diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index bb45c97a..ec4110da 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -119,8 +119,10 @@ submitSyslog(int pri, uchar *buf)
 
 	/* we have a timestamp */
 	DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs);
-	bufsize= strlen((char*)buf);
-	memmove(buf+3, buf+i, bufsize - i + 1);
+	if(!bKeepKernelStamp) {
+		bufsize= strlen((char*)buf);
+		memmove(buf+3, buf+i, bufsize - i + 1);
+	}
 
 	clock_gettime(CLOCK_MONOTONIC, &monotonic);
 	clock_gettime(CLOCK_REALTIME, &realtime);
-- 
cgit v1.2.3


From f040bde7a0454dfbc7def36a288bc70c58d878af Mon Sep 17 00:00:00 2001
From: Marius Tomaschewski <mt@suse.de>
Date: Wed, 21 Nov 2012 13:47:19 +0100
Subject: imklog: added $klogParseKernelTimestamp option

When enabled, kernel message [timestamp] is converted for message time.
Default is to use receive time as in 5.8.x and before, because the clock
used to create the timestamp is not supposed to be as accurate as the
monotonic clock (depends on hardware and kernel) resulting in differences
between kernel and system messages which occurred at same time.
---
 plugins/imklog/bsd.c | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'plugins/imklog/bsd.c')

diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index ec4110da..06032373 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -85,6 +85,9 @@ submitSyslog(int pri, uchar *buf)
 	struct timeval tv;
 	struct timeval *tp = NULL;
 
+	if(!bParseKernelStamp)
+		goto done;
+
 	if(buf[3] != '[')
 		goto done;
 	DBGPRINTF("imklog: kernel timestamp detected, extracting it\n");
-- 
cgit v1.2.3


From b78af2aaf546cee90671513be39d8e3717f2ace6 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Thu, 22 Nov 2012 08:57:57 +0100
Subject: bugfix: imklog mistakenly took kernel timestamp subseconds as
 nanoseconds

... actually, they are microseconds. So the fractional part of the
timestamp was not properly formatted.
Thanks to Marius Tomaschwesky for the bug report and the patch idea.
---
 plugins/imklog/bsd.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

(limited to 'plugins/imklog/bsd.c')

diff --git a/plugins/imklog/bsd.c b/plugins/imklog/bsd.c
index 06032373..17d4bead 100644
--- a/plugins/imklog/bsd.c
+++ b/plugins/imklog/bsd.c
@@ -76,9 +76,9 @@ static void
 submitSyslog(int pri, uchar *buf)
 {
 	long secs;
-	long nsecs;
+	long usecs;
 	long secOffs;
-	long nsecOffs;
+	long usecOffs;
 	unsigned i;
 	unsigned bufsize;
 	struct timespec monotonic, realtime;
@@ -109,9 +109,9 @@ submitSyslog(int pri, uchar *buf)
 	}
 	
 	++i; /* skip dot */
-	nsecs = 0;
+	usecs = 0;
 	while(buf[i] && isdigit(buf[i])) {
-		nsecs = nsecs * 10 + buf[i] - '0';
+		usecs = usecs * 10 + buf[i] - '0';
 		++i;
 	}
 	if(buf[i] != ']') {
@@ -121,7 +121,7 @@ submitSyslog(int pri, uchar *buf)
 	++i; /* skip ']' */
 
 	/* we have a timestamp */
-	DBGPRINTF("kernel timestamp is %ld %ld\n", secs, nsecs);
+	DBGPRINTF("kernel timestamp is %ld %ld\n", secs, usecs);
 	if(!bKeepKernelStamp) {
 		bufsize= strlen((char*)buf);
 		memmove(buf+3, buf+i, bufsize - i + 1);
@@ -130,20 +130,20 @@ submitSyslog(int pri, uchar *buf)
 	clock_gettime(CLOCK_MONOTONIC, &monotonic);
 	clock_gettime(CLOCK_REALTIME, &realtime);
 	secOffs = realtime.tv_sec - monotonic.tv_sec;
-	nsecOffs = realtime.tv_nsec - monotonic.tv_nsec;
-	if(nsecOffs < 0) {
+	usecOffs = (realtime.tv_nsec - monotonic.tv_nsec) / 1000;
+	if(usecOffs < 0) {
 		secOffs--;
-		nsecOffs += 1000000000l;
+		usecOffs += 1000000l;
 	}
 	
-	nsecs +=nsecOffs;
-	if(nsecs > 999999999l) {
+	usecs += usecOffs;
+	if(usecs > 999999l) {
 		secs++;
-		nsecs -= 1000000000l;
+		usecs -= 1000000l;
 	}
 	secs += secOffs;
 	tv.tv_sec = secs;
-	tv.tv_usec = nsecs / 1000;
+	tv.tv_usec = usecs;
 	tp = &tv;
 
 done:
-- 
cgit v1.2.3