[Prev][Next][Index][Thread]

Re: Time

> >preamble reference should suffice, plus an inline reference whenever
> >daylight savings kicks in or out.
> Two new directives?
> #GMT-Offset: -0400
> #Daylight-Savings: on

Why two? Shouldn't the offset to GMT be sufficient? 

> Is the second one descriptive enough, or do we need "on" and "off" for the
> beginning of logs, and "on-to-off" and "off-to-on" for times when we
> actually switch during logging?

Why not just dump a GMT-Offset directive with the new offset?

There was an earlier note about wanting some server-specific
information that would be identical on all lines in many log files.
For instance, if the log file includes entries for only one server,
including s-dns or s-ip on each line is pretty wastefull: It seems
like a generic mechanism for doing this - along with some things for
GMT-Offset, etc - would be more usefull.

I've got two proposals for this:

1) A two-line version to cut down the overhead:

#Preamble-Fields: <field identifiers>
#Preamble: <entry>

So you might do something like:

#Preamble-Fields: s-dns s-gmtoffset s-dst
#Preamble: www.phony.domain -600 1

2) A single-line version which is less painfull to parse but requires
more bytes:

#Field: <field identifier>: <value>

so the above becomes:

#Field: s-dns: www.phony.domain
#Field: s-gmtoffset: -600
#Field: s-dst: 1

Hmm. Thinking about it, I like the latter one, with the semantics that
a "#Field" directive provides a field identifier and value for that
identifier that analysis software should use as the default for all
following entries. People are already using this behavior for #Date:
directives.

A missing value (-) in a Field directive would indicate that the
identifier should NOT have a default value for following entries.

	<mike
References: