Re: Timestamps in logs files without any msec
"Seth Hall" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
On 2 Apr 2019, at 13:10, Arda Savran wrote: > Is there a way to use the Unix timestamp without any msec in log > files? At > the moment, msec is included in the timestamp. Hm, good question. I don't think there is going to be a "good" way to do it. If you *really* want to do it you could modify the ascii formatter to make it reduce the decimal points off the end of the value. There may be side effects if you do this though, I really haven't thought through it much. Here's the line that renders that field... https://github.com/zeek/zeek/blob/master/src/threading/formatters/Ascii.cc#L118 .Seth -- Seth Hall * Corelight, Inc * www.corelight.com _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek