It is just returning the subsecond *part* of the timestamp. So while 9:13:14.123 is "higher" than 8:13:14.567, the subsecond part of the later (567) is higher than the subsecond part of the earlier (123).
It is important that you are extracting a partial timestamp, which also implies that this is no longer monotonically increasing. Actually, it no longer has any sense of "timing" at all. This is NOT the timestamp converted to nanoseconds (or whatever). I hope this clarifies, if not, keep posting ;) Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of Luigi Perroti > Sent: Wednesday, October 01, 2008 10:58 AM > To: [email protected] > Subject: [rsyslog] Subseconds in timereported and timegenerated > > Hi, > > I'd like to ask if it's normal that %timegenerated:::date-subseconds% > returns a value lower than %timereported:::date-subseconds%. > > Intuitively I'd say it is since this makes sense by taking in > consideration the property names. > Still, since the documentation says that timegenerated is the > timestamp when the message was received I would have expected a value > higher than the one returned by timereported. > > I'm afraid this is a dumb question but this behaviour got me confused, > if anyone could shed some light on this I'd be grateful. Thanks. > > Regards, > Luigi > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
