Detail file reader header detection sucks

[Alan DeKok]

Arran Cudbard-Bell wrote:
> Yeah, but the configuration option still exists. I got caught out
> changing the %t to a %T, as I was assuming the detail reader used the
> header for Packet-Original-Timestamp (when in fact it's reformatting the
> Unix timestamp included in the packet).

  Yes...

> I need database formatted or unix timestamps for inserting command logs
> into a database... I can convert c timestamps using unlang, but it's not
> pretty.

  Use %S.

> I guess, but what do you want to do if that happens? Because at the
> moment if the headers not detected correctly, it just skips on down and
> uses the first attribute with a timestamp as its value, missing out half
> the attributes in the process.

  Hmm... that needs to be fixed then.

> I guess this isn't that much of a problem, but I still think just
> checking for a non-indented line gives more predictable behaviour, even
> with corruption.

  OK.

  Alan DeKok.