Hi John,
In my daily report, I always have a lot of stuff in the "Unknown
entries" section:
Unknown entries from news log file:
First 50 / 3351 lines (1.5%)
2023-07-23T04:15:01.882775+00:00 localhost innd: ctlinnd command E
Timestamps in my news log files look like:
[news.notice]
Jul 29 04:15:01 news innd[3334925]: ctlinnd command E
[news]
Jul 29 04:35:01.632 + feed.usenet-fr.net [...]
I've just checked, and it seems that the innreport script only handles
lines with a format like the above ones:
($day, $hour, $prog, $left)
=~ m/^(\S+\s+\S+) (\S+) \S+ (\S+): (.*)$/o;
It is the low-precision timestamp used by syslog.
This is Debian 12, if that's helpful.
https://www.debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html#rsyslog-timestamp-change-affects-logcheck
rsyslog now defaults to “high precision timestamps” which may affect
other programs that analyze the system logs.
Oh, this is an unexpected change which unfortunately breaks daily Usenet reports as innreport does not cope with that new setting :-/
I bet inn2 is not the only package which broke with that change...
It's probably worthwhile a fix in Debian stable (12) as innreport is
broken. I'll send a mail to Marco (the inn2 package maintainer) as I am
unsure he reads us here.
FWIW, the high-precision timestamp is enabled with a line like this one
in rsyslog.conf:
$ActionFileDefaultTemplate RSYSLOG_FileFormat
instead of RSYSLOG_TraditionalFileFormat (low-precision).
Anyway, innreport should really support high-precision timestamps.
Could you please try the following patch and tell me whether it works
for your next daily reports?
I've tested it with a test file on my system, and innreport correctly recognizes "2023-07-23T04:15:01.882775+00:00" with it:
Control commands to INND:
Command Number
logmode 1
TOTAL: 1 1
--- scripts/innreport.in
+++ scripts/innreport.in
@@ -95,6 +95,7 @@
use strict;
use Carp qw( cluck confess );
use Time::Local;
+use Time::Piece;
## Default display configuration file (parameter added in INN 2.7.0).
my $DISPLAY_FILE = 'innreport-display.conf';
@@ -452,6 +453,18 @@ while (!eof()) {
my ($res, $day, $hour, $prog, $left);
DECODE:
{
+ # Convert a high-precision timestamp like
+ # 2023-07-23T04:15:01.882775+02:00
+ # to the low-precision timestamp used by innreport.
+ if ($_ =~
/^(\d+-\d+-\d+T\d+:\d+:\d+)(\.\d+)?([+-]\d+):?(\d+)/) {
+ my $t = Time::Piece->strptime(
+ "$1 $3$4",
+ "%Y-%m-%dT%T %z"
+ );
+ my $newdate = $t->monname . " " . $t->mday . " " . $t->hms;
+ $_ =~ s/^\S+/$newdate/;
+ }
+
($day, $hour, $prog, $left)
= $_ =~ m/^(\S+\s+\S+) (\S+) \S