How to Enable High-Precision Syslog?

[yottabit]

Does BSD syslog support high-precision timestamps? I can't seem to find anything in the man pages or online to enable this. Everything seems geared toward rsyslog and syslog-ng.

Thanks for any help! Would prefer to use default syslog if possible, since I otherwise have everything setup.

 

[dlavigne]

What are you looking for in "high-precision"?

 

[yottabit]

What are you looking for in "high-precision"?

Milliseconds would be plenty.

 

[jgreco]

While the latest syslog protocol (RFC5424) theoretically supports syslog precision down to the microsecond, real-world support for this is lacking. Most implementations are conformant with the earlier RFC3164 syslog protocol, which was basically just an RFC that documented longtime existing practice dating back to the origins of syslogd.

libc's syslog() function has historically been backed by time(3) which limits timestamp resolution to the second. This offers the highest degree of compatibility with historical implementations. FreeBSD 12 has started to use gettimeofday(2) in syslog(), and has modified syslogd to support optional high-res timestamps through the '-O format' argument.

It's worth noting that FreeNAS is currently based on FreeBSD 11, and also uses syslog-ng rather than the base system's syslogd, so the options matrix is kinda complicated. If you could explain what it is you are trying to accomplish, I might be able to make some more specific and relevant comments.

 

[yottabit]

Ah, that's great info. Thank you!

I have a bunch of routers and APs that log to syslog on a FreeNAS jail. I'm assuming, based on the manpages, that the jail is running the basic syslog. It was a bit of a hassle to get it set up the way I wanted, so I was hoping it would be an easy option to enable millisecond resolution. That precision makes correlating fast network events much easier.

I'll look into rsyslog and syslog-ng to see which may be the easiest transition from my current config.

It's also worth noting that this jail was created in the old Warden system and I haven't yet migrated it to iocage, so the BSD version in the jail is old.

Thanks again!

 

[jgreco]

You might be able to run a FreeBSD 12 jail and run with "-O syslog" flag to syslogd.

I believe that syslog-ng also has support for extended timestamps, so installing a port of syslog-ng in your existing jail seems a potential option as well.

Good luck and feel free to report back what worked for you.