[Mimedefang] RE: graphdefang and remote syslogs question

[Dan Tulovsky]

Hi...

Also, while this helps with multiple log files, it doesn't solve the
time zone issue.  I added the following code into graphdefanglib.pl:

                if ($host eq "smtp1") {
                        $unixtime = $unixtime + 10800;
                        # print $unixtime . " - smtp1\n";
                }

Right before:

                # don't examine the line if it is greater than 5 minutes
                # older than the maximum time in our DB.  The 5 minutes
                # comes from the PID, From, and Relay caching with
sendmail
                # and spamd that occurs below.
                last if ($unixtime < ($MaxDBUnixTime-60*5));

Which add 3 hours to the host logging from california.... Otherwise the
graphs come out wrong, as they thing that it is local time, but 3 hours
before...

So if you are going to keep track of the max time on a per host basis,
there should probably be some way of setting the proper time zone for
each host and take that into account for the graphs...

Thank you,
Dan


> -----Original Message-----
> From: John Kirkland [mailto:jpk at bl.org] 
> Sent: Wednesday, June 18, 2003 4:06 PM
> To: 'mimedefang at lists.roaringpenguin.com'
> Subject: Re: [Mimedefang] RE: graphdefang and remote syslogs question
> 
> 
> 
> Alain,
> 
> I added the following 2 features to graphdefang today:
> 
>         * added host-based max time tracking
>         * added ability to load logs from more than one datafile
> 
> It will use the hostname from the syslog files to seperately 
> track a max time per host.
>