[Dnsmasq-discuss] [PATCH] Convert dnsmasq log timestamp to use timespec.

[Cody Carey]

This patch converts log timestamps to an RFC3339 format and includes
nanoseconds. This provides more complete timestamp information and
granularity. This is particularly important when dealing with SIEM's
and other log analysis systems where less specific timestamps can
cause out-of-order issues, particularly where UDP is used.

>From ffd56111d61021f709967caf3767fbda19785d20 Mon Sep 17 00:00:00 2001
From: Cody Carey <17598826+codyacarey at users.noreply.github.com>
Date: Sun, 11 Oct 2020 17:01:59 -0400
Subject: [PATCH] Convert dnsmasq log timestamp to use timespec.

Signed-off-by: Cody Carey <17598826+codyacarey at users.noreply.github.com>
---
 src/log.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/log.c b/src/log.c
index dbd6bd4..6e273aa 100644
--- a/src/log.c
+++ b/src/log.c
@@ -278,7 +278,7 @@ void my_syslog(int priority, const char *format, ...)
 {
   va_list ap;
   struct log_entry *entry;
-  time_t time_now;
+  struct timespec ts;
   char *p;
   size_t len;
   pid_t pid = getpid();
@@ -364,14 +364,20 @@ void my_syslog(int priority, const char *format, ...)
          tmp->next = entry;
        }

-      time(&time_now);
+      timespec_get(&ts, TIME_UTC);
       p = entry->payload;
       if (!log_to_file)
        p += sprintf(p, "<%d>", priority | log_fac);

       /* Omit timestamp for default daemontools situation */
       if (!log_stderr || !option_bool(OPT_NO_FORK))
-       p += sprintf(p, "%.15s ", ctime(&time_now) + 4);
+        {
+          char timestamp[100];
+          char timezone[6];
+          strftime(timestamp, sizeof timestamp, "%FT%T", gmtime(&ts.tv_sec));
+          strftime(timezone, sizeof timezone, "%z", gmtime(&ts.tv_sec));
+          p += sprintf(p, "%s.%09ld%s ", timestamp, ts.tv_nsec, timezone);
+        }

       p += sprintf(p, "dnsmasq%s[%d]: ", func, (int)pid);

--
2.25.1