[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: slapo-accesslog: wrong timestamp microseconds

On Thu, Feb 18, 2016, at 12:05 PM, Howard Chu wrote:
> Dario Zanzico wrote:
> > In adding an accesslog overlay I noticed something strange with the reqstart
> > and reqend  fields:
> > the fractional part always begins with 000 and has this strange distribution.
> 
> The fractional part is a simple counter in reqstart/reqend, not true
> microseconds.

Ok, for my use-case this is not a problem, but won't this break
ordering?
If collecting events from slapo-accesslog filtered by 
'reqstart>=$last_read_reqstart'
this means $last_read_reqstart should be truncated to seconds, or risk
missing some auditObject

> > This is on the last 10 minutes of entries, which I expected to be 'kind of'
> > randomly distributed; Instead no entry has a reqstart with a fractional part
> > bigger than .000177, and the vast majority of them has it < .000050
> > Anybody knows what can be the cause of this, and how to correct it?
> 
> There's nothing to correct, this is working as designed.
> 
> The fractional part is only there to for disambiguating when multiple 
> operations occur in the same 1-second interval.

the manpage refers tho those fields as generalizedTime ("reqStart and
reqEnd provide the start and end time of the operation, respectively.
They use generalizedTime syntax."), in which the numeric part after the
period/comma is defined as a time fraction (in this case a seconds
fraction)

Thanks,
dario