How to parse syslog timestamp

Question

http://www.syslog.cc/ietf/drafts/draft-ietf-syslog-protocol-23.txt

6.2.3.1. The examples in the above link provide examples of various time stamp formations.

How can I parse these timestamps in C ?

any type of message can arrive on the fly, and I want to analyze it.

Answer 1

The date format is a more stringent version of RFC3339 with a string, such as '2011-08-18T23: 31: 42Z'

I'm not sure if the strptime function can handle the time zone specifier (Z in the timeline above), so it may be easier to handle this inside your own function. It definitely cannot handle fractional seconds, since struct tm does not process them. You can use struct timespec to store fractional seconds if required.

You can parse most of the format with strptime:

 struct tm tm; time_t t char *extra; extra = strptime( tmstr, "%C%y-%m-%dT%H:%M:%S", &tm ); tm.tm_isdst = -1; t = mktime( &tm ); 

After that, the extra amount will be the rest of the input tmstr. This may include fractional seconds and will then contain the time zone format. If additionally begins with. just parse the number with strtod function:

 if( extra && extra[0] == '.' ) { char *endptr; fraction = strtod( extra, &endptr ); extra = endptr; /* use timespec if fractional seconds required */ struct timespec ts; ts.tv_sec = t; ts.tv_nsec = fraction * 1000000000; } 

Then, the additional information will now contain the time zone specifier. If it is "Z", we are done, since mktime gives you UTC time. Otherwise, you get an offset, for example. +03: 00, so you will need to change your time to this number of hours / minutes.