On Thu, Feb 18, 2016, at 12:05 PM, Howard Chu wrote:
Dario Zanzico wrote:
In adding an accesslog overlay I noticed something strange with the reqstart and reqend fields: the fractional part always begins with 000 and has this strange distribution.
The fractional part is a simple counter in reqstart/reqend, not true microseconds.
Ok, for my use-case this is not a problem, but won't this break ordering? If collecting events from slapo-accesslog filtered by 'reqstart>=$last_read_reqstart' this means $last_read_reqstart should be truncated to seconds, or risk missing some auditObject
This is on the last 10 minutes of entries, which I expected to be 'kind of' randomly distributed; Instead no entry has a reqstart with a fractional part bigger than .000177, and the vast majority of them has it < .000050 Anybody knows what can be the cause of this, and how to correct it?
There's nothing to correct, this is working as designed.
The fractional part is only there to for disambiguating when multiple operations occur in the same 1-second interval.
the manpage refers tho those fields as generalizedTime ("reqStart and reqEnd provide the start and end time of the operation, respectively. They use generalizedTime syntax."), in which the numeric part after the period/comma is defined as a time fraction (in this case a seconds fraction)
Thanks, dario