I've been working on building a Collector that accepts syslog feed in
the standard RFC 3164 message format of
Mon DD HH:MM:SS (host) (message)

The Collector Manager is configured to use EDT.
The Event Source is configured to use UTC/GMT

When digging into the debugging I ran into this section of code that
gets called from Record.prototype.preParse() specifically the lines:


this.syslogMsg = this.s_RXBufferString.parseSyslog();


The following is a snippet from parseSyslog();


if (this.search(/^(\w+\s+\d+\s+\d+:\d+:\d+)\s+(\S+)\s+(.*)$/) != -1) {
var date_str = RegExp.$1;
var sysDate = new Date();
var date_year = sysDate.getFullYear();

msg.reporterip = RegExp.$2;
msg.message = RegExp.$3;
msg.date = Date.parseExact(date_str + " " + date_year, "MMM dd HH:mm:ss yyyy");
// Handle old data from last year
if (msg.date.isAfter(sysDate.add({ hours: 2 }))) {
msg.date.setFullYear(date_year - 1);


Timezone isn't used in here and all timezones appear to be set to
whatever local timezone is set on the Collector Manager.

At the year check msg.date.isAfter() here's an example of values I saw
in the debugger:

date_str Apr 26 03:38:36
msg->date Tue Apr 26 2011 03:38:36 GMT-0400 (EDT) <--- this should be
sysDate Tue Apr 26 2011 01:41:00 GMT-0400 (EDT)

It looks like this may be resolved by running adjustTimezone() before
running the year check.

drutstein's Profile: http://forums.novell.com/member.php?userid=48462
View this thread: http://forums.novell.com/showthread.php?t=437507