toolong icon indicating copy to clipboard operation
toolong copied to clipboard

Incorrect syslog timestamp

Open tstack opened this issue 5 months ago • 0 comments

Description

When viewing a syslog file, the timestamp reports as the year 1900.

How to reproduce

Open a syslog file that has lines like:

Feb 11 20:44:26 Foo-MacBook-Air AMPDeviceDiscoveryAgent[1574]: Entered:__thr_AMMuxedDeviceDisconnected, mux-device:682
Feb 11 20:45:07 Foo-MacBook-Air AMPDeviceDiscoveryAgent[1574]: Entered:_AMMuxedDeviceDisconnected, mux-device:683
Feb 11 20:45:07 Foo-MacBook-Air AMPDeviceDiscoveryAgent[1574]: Entered:__thr_AMMuxedDeviceDisconnected, mux-device:683

Check the time reported in the bottom right, it will have "02/11/1900".

Details

For timestamps that are missing components, it's probably best to use the file's timestamp as a basis. Note that you will also need to keep track of differences from the previous timestamp in order to detect a rollover. For example, if the previous timestamp was "Dec 31" and the next was "Jan 01", you'll need to go back through the previously scanned dates to subtract a year to get the correct timestamp.

tstack avatar Feb 12 '24 05:02 tstack