[squid-users] logformat: override %tg, but keep subsecond resolution

[Amos Jeffries]

On 23/04/20 2:29 am, Andreas Hasenack wrote:
> Hi,
> 
> I'm trying to override the %tg log format but keep its subsecond time
> resolution.
> 
> As a reminder, %tg gives you this:
> 
> 22/Apr/2020:14:14:18.360
> 
> I would like it to be
> 
> 2020-04-22 14:14:18.360 +0000
> 
> I tried this first: %tg{%F %H:%M:%S %z}
> 
> That gave me 2020-04-22 14:14:18 +0000, so it's just missing the
> milliseconds. And this is where I couldn't figure it out anymore.
> 
> Some combinations I tried, ranging from thoughtful experiments to just
> random attempts:
> %tg{%F %H:%M:%S %z}.%03tu -> 2020-04-22 14:14:18 +0000.360
> %tg{%F %H:%M:%S.%03f %z} -> 2020-04-22 14:14:18.%03f +0000
> %tg{%F %H:%M:%S.%03tu %z} -> ??? 2020-04-22 14:14:18.00  u +0000
> 

The content of {} brackets on Squid time macros is all arguments for
strftime(). Supported codes are system locale dependent. Documentation
can be found at <http://www.cplusplus.com/reference/ctime/strftime/>

The characters outside {} are Squid logformat codes. Documentation for
those can be found at <http://www.squid-cache.org/Doc/config/logformat/>


> What's the right format string I should use? I also checked
> strftime(3) but couldn't figure it out.
> 

strftime() displays UNIX time values. Unix time_t has a 1 second
resolution, so sub-second values are not supported.

To inject a custom value into the middle of a standardized time format
string you need multiple %code's for Squid. Like so:

  %tg{%F %H:%M:%S}.%03tu %tg{%z}


Or, since the timezone is always expected to be "+0000" you can just
configure this and save CPU cycles looking up the timezone offset:

 logformat customTime %tg{%F %H:%M:%S}.%03tu +0000


HTH
Amos