|On Wed, 9 Nov 2022 at 16:09, Stefan Kangas <stefankan...@gmail.com> wrote:
> In rsyslog 8.2210.0-3, the timestamp format was changed to be high
> precision by default. It now looks like this:
>
> 2022-11-09T15:02:03.157819+01:00
>
> I believe this part of all rules:
>
> ^\w{3} [ :[:digit:]]{11}
>
> Must be changed into something like:
>
> ^[[:digit:]-T:.+]{32}
>
I suggest it needs to keep the 'old' prefix as an alternative - for people
that revert the rsyslog setting and for people who enable checking of the
journal, which uses the old format. so rules need to begin with the form
'^(old|new) ...'
Also we should add NEWS.Debian as this affects all local rules too.
i can submit a patch. but will need the maintainer (Jose) DD to upload.
> I have marked this bug "important" for now, but I'd suggest bumping it
> to "serious" as this seems release-critical to me.
+1 on this being important. im not sure a higher severity is technically
correct. And would it help get it actioned or just result in logcheck being
dropped?.... i dont want to see the latter.
We now have two important bugs which affect every user of logcheck in
testing. The bookworm freeze is fast approaching...
Jose if you are reading this, how can we help you get these fixed?
