LoGS 0.1.2 released 9/22/2006
SSH Scanning Jerks
Document Actions
Supporting Times
Offline Mode/Parsing Timestamps
Supporting working with time, especially for "offline mode" seems important.
One should be able to (painlessly) tell LoGS to be in "offline mode". Offline mode seems to imply at least:
- Not using the internal-time
- Parse the timestamps on the log messages; use them to set *now*
- *LoGS-INTERNAL-TIME-UNITS-PER-SECOND* should be set to the resolution of 1
(In "online mode", this is the value of INTERNAL-TIME-UNITS-PER-SECOND or 100 under CMUCL).
In order to support this, we introduced the --parse-timestamp, --timestamp-start, and --timestamp-end flags.
--parse-timestamp causes LoGS to not use the internal-time and, instead, to set *now* by parsing the timestamp on the line. I'm not exactly sure what will happen when you parse a syslog file from, say leap day, when this year doesn't have a leap day! LoGS will probably die a flaming death and take you with it!
--timestamp-start causes LoGS to look at this position in the line for the start of the timestamp. This sets the internal variable *timestamp-start*. The default value of *timestamp-start* is 0.
--timestamp-end causes LoGS to use this position in the line for the end of the timestamp. This sets the internal variable *timestamp-end*. The default value of *timestamp-end* is 15.
Time formats:
Right now, LoGS understands only the standard syslog time format. This format is:
Mon Dt HH:MM:SS
eg:
Jun 9 12:34:56