MonitorWare Knowledge Base

The date on my system is correct, but for some reason the year displayed by phplogcon is showing "2007" instead of "2008". It is incorrect both at the main screen, and at the message detail screen. Any idea where this is being picked up? (Running v2.5.21)

[root@splunk phplog]# date
Wed Dec 3 07:46:08 EST 2008

http://10.255.231.148/phplog/index.php? ... highlight=
http://10.255.231.148/phplog/details.php?uid=137239

Date 2007-12-02 14:23:41
Host 10.22.86.1
Messagetype Syslog
Syslogtag Kiwi_Syslog_Daemon
Message Dec 2 14:23:41 10.22.86.1 MSWinEventLog#0110#011Security#01135982#011Tue Dec 02 14:23:40 2008#011567#011Security#011POS#011User#011Success Audit#011POS0208971#011Object Access#011#011Object Access Attempt: Object Server: Security Handle ID: 2244 Object Type: File Process ID: 744 Image File Name: wendposy.exe Access Mask: WriteData (or AddFile) AppendData (or AddSubdirectory or CreatePipeInstance) #0117608443

• Custom phpLogCon configuration?
• Maintenance Contract?
• Installation support?

Which Version of PHP do you have installed? This is a odd problem, I see from your sample message that we have a typical RFC 3164 date header which doesn't contain a year. What phpLogCon internally does is to convert this into a full timestamp we can use internally, php should automatically assign the current year to this timestamp, what it actually does not seem to do here.

A workaround that might solve the problem already you can try, please edit the file include/functions_common.php
Search for this code:

Code: Select all

$eventtime[EVTIME_TIMESTAMP] = mktime($out[3], $out[4], $out[5], GetMonthFromString($out[1]), $out[2]);

Replace with this code:

Code: Select all

$eventtime[EVTIME_TIMESTAMP] = mktime($out[3], $out[4], $out[5], GetMonthFromString($out[1]), $out[2], date("Y") );

This should force php to use the current year on the timestamp.

--
best regards,
Andre Lorbach

alorbach wrote:Which Version of PHP do you have installed? This is a odd problem, I see from your sample message that we have a typical RFC 3164 date header which doesn't contain a year. What phpLogCon internally does is to convert this into a full timestamp we can use internally, php should automatically assign the current year to this timestamp, what it actually does not seem to do here.

[root@splunk ~]# php --version
PHP 5.2.4 (cli) (built: Oct 16 2007 09:13:35)

I will try your work around this morning and see if that fixes the problem. Thanks!

alorbach wrote:

Code: Select all

$eventtime[EVTIME_TIMESTAMP] = mktime($out[3], $out[4], $out[5], GetMonthFromString($out[1]), $out[2], date("Y") );

This should force php to use the current year on the timestamp.

Andre - Unfortunately, this code change did not fix the issue.....

Date 2007-12-08 10:08:11
Host 10.7.72.101
Messagetype Syslog
Syslogtag Kiwi_Syslog_Daemon
Message Dec 8 10:08:11 10.7.72.101 MSWinEventLog

I'm having the same problem - all dates showing 2007 instead of 2008. Changed the code as above in line 757 but that didn't solve the problem. My PHP version:

PHP 5.2.4 with Suhosin-Patch 0.9.6.2 (cli) (built: Sep 23 2007 14:12:53)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies

Are you both using kiwi syslog?
What is the log source, a database or logfile? If it is a text based logfile, please post some sample messages here.

regards,
Andre

I'm using syslog-ng 1.6. The log source is a log file and I 'manage' many logfiles via PHP Logcon.

Here's a sample log file whose Year should be "2008" but it says "2007" in PHP Logcon web interface:

Dec 11 07:20:16 nurang Service Control Manager 08 [kern.info] Service Control Manager[1034] Category:(0); User:; The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.

Any update on this? Any way I can force it to read the system date? Thanks for any help.

Hi again,

that was a silly typo in functions_common.php !
Edit: include/functions_common.php

Search for

Code: Select all

case "Dez":

Replace with:

Code: Select all

case "Dec":

This will be fixed in the next release.

best regards,
Andre Lorbach