toolong
toolong copied to clipboard
Incorrect syslog timestamp
Description
When viewing a syslog file, the timestamp reports as the year 1900.
How to reproduce
Open a syslog file that has lines like:
Feb 11 20:44:26 Foo-MacBook-Air AMPDeviceDiscoveryAgent[1574]: Entered:__thr_AMMuxedDeviceDisconnected, mux-device:682
Feb 11 20:45:07 Foo-MacBook-Air AMPDeviceDiscoveryAgent[1574]: Entered:_AMMuxedDeviceDisconnected, mux-device:683
Feb 11 20:45:07 Foo-MacBook-Air AMPDeviceDiscoveryAgent[1574]: Entered:__thr_AMMuxedDeviceDisconnected, mux-device:683
Check the time reported in the bottom right, it will have "02/11/1900".
Details
For timestamps that are missing components, it's probably best to use the file's timestamp as a basis. Note that you will also need to keep track of differences from the previous timestamp in order to detect a rollover. For example, if the previous timestamp was "Dec 31" and the next was "Jan 01", you'll need to go back through the previously scanned dates to subtract a year to get the correct timestamp.