sorting timestamps with and without year

[tim-timpani]

Where do we stand on combining logs some with and some without the year in the timestamp? Many other projects assume current year and treat new year as an edge case. Can we at least offer it as an option (env var would be real nice for that so we don't have to add more to the command line)? This is especially helpful when troubleshooting same-day events across multiple services where some do not include the year.

[tstack]

Where do we stand on combining logs some with and some without the year in the timestamp?

If the log messages do not include the year/month/etc... lnav will use the file timestamp to figure those values out. If a rollover is detected while processing messages, then the previously processed messages will have their timestamps rolled back. Here's some examples from the test suite:

lnav/test/test_logfile.sh

Lines 253 to 307 in ace6394

	touch -t 200711030923 ${srcdir}/logfile_syslog.1
	run_test ./drive_logfile -t -f syslog_log ${srcdir}/logfile_syslog.1
	check_output "Syslog timestamp interpreted incorrectly for year end?" <<EOF
	Dec 03 09:23:38 2006 -- 000
	Dec 03 09:23:38 2006 -- 000
	Dec 03 09:23:38 2006 -- 000
	Jan 03 09:47:02 2007 -- 000
	EOF
	touch -t 200711030000 ${srcdir}/logfile_rollover.0
	run_test ./drive_logfile -t -f generic_log ${srcdir}/logfile_rollover.0
	check_output "Generic timestamp interpreted incorrectly for day rollover?" <<EOF
	Nov 02 00:00:00 2007 -- 000
	Nov 02 01:00:00 2007 -- 000
	Nov 02 02:00:00 2007 -- 000
	Nov 02 03:00:00 2007 -- 000
	Nov 03 00:00:00 2007 -- 000
	Nov 03 00:01:00 2007 -- 000
	EOF
	gzip -c ${srcdir}/logfile_syslog.1 > logfile_syslog.1.gz
	run_test ./drive_logfile -t -f syslog_log logfile_syslog.1.gz
	check_output "Syslog timestamp incorrect for gzipped file?" <<EOF
	Dec 03 09:23:38 2006 -- 000
	Dec 03 09:23:38 2006 -- 000
	Dec 03 09:23:38 2006 -- 000
	Jan 03 09:47:02 2007 -- 000
	EOF
	if [ "$BZIP2_SUPPORT" -eq 1 ] && [ x"$BZIP2_CMD" != x"" ] ; then
	$BZIP2_CMD -z -c "${srcdir}/logfile_syslog.1" > logfile_syslog.1.bz2
	touch -t 200711030923 logfile_syslog.1.bz2
	run_test ./drive_logfile -t -f syslog_log logfile_syslog.1.bz2
	check_output "bzip2 file not loaded?" <<EOF
	Dec 03 09:23:38 2006 -- 000
	Dec 03 09:23:38 2006 -- 000
	Dec 03 09:23:38 2006 -- 000
	Jan 03 09:47:02 2007 -- 000
	EOF
	fi
	touch -t 201404061109 ${srcdir}/logfile_tcf.1
	run_test ./drive_logfile -t -f tcf_log ${srcdir}/logfile_tcf.1
	check_output "TCF timestamp interpreted incorrectly for hour wrap?" <<EOF
	Apr 06 09:59:47 2014 -- 191
	Apr 06 10:30:11 2014 -- 474
	Apr 06 11:01:11 2014 -- 475
	EOF

The first case is a syslog file where there is no year, so that's taken from the file timestamp (or the timestamp embedded in the gzip file) that is set to a specific time for the test. The last case is more extreme since the format only has minutes, seconds, and milliseconds.

Can we at least offer it as an option (env var would be real nice for that so we don't have to add more to the command line)?

I'm not sure what you're thinking of here, can you elaborate or does the above cover your need?