Honor the TZ variable by converting timezones on the fly

[jefft]

I have a server running on UTC, with apps that log UTC dates without a timezone specifier:

2019-12-10 21:37:55,685 WARN .....

I also have pesky users who report problems in non-UTC, like "4pm in Los Angeles".

I would love to be able to run:

TZ='America/Los_Angeles' lnav atlassian-confluence.log

and have lnav translate those UTC dates to (in this case) PST.

[cw1nte]

I came across similar time zone issues between different logging sources on a single machine... I think it was in how the time was shown (Summer time on or off etc).

[tstack]

This works for some log formats (like JSON logs where the displayed log message is generated dynamically), but is not consistently supported. The :adjust-log-time command should work for all formats, but only works a file-at-a-time. You can use a SQL query to update the time_offset column of the lnav_file table to do it en masse.

[NikEyX]

Thanks for pointing me here. Agreed, :adjust-log-time / time_offset works, but this does require knowledge on the current time differential. When reviewing logs that span several weeks this isn't necessarily feasible because the time differential is dependent on the time of the year due daylight savings, and thus isn't constant. Would you be able to add a feature like @jefft mentioned? I think it would be incredibly useful to start lnav with a given timezone and all timestamps will be converted accordingly.

EDIT: it also seems that :adjust-log-time doesn't work well if used across many different files (i.e. when launching lnav *.log). Only seems to adapt the latest file in my case, unless I am missing something.

[tstack]

I've pushed a change that will convert timestamps that include a timezone to the local time. Unfortunately, this won't quite work for the original request since 2019-12-10 21:37:55,685 doesn't have Z or a numeric offset (like -03:00). I'm not sure what to do about that yet. Let me know if you have any thoughts.

Oof, a year before I first responded and then almost four before actually doing something about it. Sorry folks...

[jefft]

This is a really useful change, thanks! So for a sample access.log:

localhost:443 1.2.3.4 cger1e khenry [10/Aug/2023:01:00:00 -0700] "GET /bar HTTP/2.0" 200 16517 "-" "Mozilla/5.0" 156302
localhost:443 1.2.3.4 1j0vhgd jsmith [10/Aug/2023:02:00:00 -0700] "GET /foo HTTP/2.0" 200 17163 "-" "Mozilla/5.0" 116075

Old lnav showed the timestamps in their native timezone:

Now lnav shows the timestamps in the computer's local timezone (here AEST, +1000):

or to whatever TZ says, e.g. TZ=UTC:

log_time and log_actual_time are translated too. All excellent.

There is a minor bug, in that the timezone offset is always +0000. Try TZ=Australia/Sydney (aka AEST aka +1000):

The first timestamp should be 10/Aug/2023:18:00:00 +1000, not 10/Aug/2023:18:00:00 +0000.

[tstack]

@jefft Thanks for hanging around and trying out the change, I really appreciate it! I've pushed a change to show the offset. Here's your example: