Arran Cudbard-Bell wrote:
Yeah, but the configuration option still exists. I got caught out changing the %t to a %T, as I was assuming the detail reader used the header for Packet-Original-Timestamp (when in fact it's reformatting the Unix timestamp included in the packet).
Yes...
I need database formatted or unix timestamps for inserting command logs into a database... I can convert c timestamps using unlang, but it's not pretty.
Use %S.
I guess, but what do you want to do if that happens? Because at the moment if the headers not detected correctly, it just skips on down and uses the first attribute with a timestamp as its value, missing out half the attributes in the process.
Hmm... that needs to be fixed then.
I guess this isn't that much of a problem, but I still think just checking for a non-indented line gives more predictable behaviour, even with corruption.
OK. Alan DeKok.