tstack
syslog timestamps
I am making a syslog-like from dtrace, but the only date printf-ing I have ever found in dtrace is a %Y which includes the year. AFAIK there is no option to print to a string and substring etc, SO my logs must look like:
2021 Nov 19 09:15:05 MBP115 dtrace[11915]: START: LF=5s+growing slower,HF= last 1.3s higher use (filter?). Activity->+** 2021 Nov 19 09:15:06 MBP115 dtrace[11915]: HF_BUSY_PROCS 4454=seen_tot tr6/name xSt PID TID SchFl cpu seen / last 1333ms 15% ** // lnav 4 11043 27818987 6 0 990/ lnav 4 11043 27818987 0 0 938/ lnav 4 11043 27818987 2 0 609/ lnav 4 11043 27818987 4 0 459/ iTerm2 4 1196 5379 4 0 280/ iTerm2 4 1196 5379 0 0 166 2021 Nov 19 09:15:06 MBP115 dtrace[11915]: HF_SUMRY_SAMPLES /lnav=4 11043 27818987 6 0 990=top_of 4454_app,kern 25048(idle 24360,82%) // last 1333ms 15% ** 2021 Nov 19 09:15:06 MBP115 dtrace[11915]: HF_DET_WAITS 4 tr4/name xSt PID TID SchFl seen / last 1333ms 15% ** # / opendirectoryd 5 84 0 1/ notifyd 5 112 0 1/ FMCore 5 1788 0 1/ Epson Scanner Mo 5 1765 0 1 2021 Nov 19 09:15:06 MBP115 dtrace[11915]: HF_DET_FLAGS 15 tr4/name xSt PID TID SchFl seen / last 1333ms 15% ** # / thunderbird 4 45115 400 2/ WindowServer 4 199 8 2/ sqlite3 4 11926 10 1/ bash 4 11927 10 1
I think this would work as a syslog if the timestamp capture allowed an optional year+space, maybe even throwing it away?? I could have a go modding the syslog_log.json.sample file but my grep-ing would be challenged and then I'm not sure if the subsequent date/time routines would be happy, plus I might mess up capture group ordering etc. Thus I am unconfident I'd even know why it was not working (if it did not).
Any chance of this being an easy fix/extension, just the addition to the appropriate capture? If this IS added to the standard current version is there a way I can apply to my older version (seems easy if just the json file)....
