As we all know "unix" can have anything in a file except '/' and '\0', sysadmins however tend to have a much smaller preference, mainly due to nothing liking spaces as input ... and a bunch of things having a special meaning for ':' and '@' among others.
Recently I'd seen yet another case where a timestamp was used in a filename, and after playing with different formats a bit to make it "better" I figured I'd try to find a "best practice", not seeing one I figured I'd just ask here and see what people thought.
Possible "common" solutions (p=prefix and s=suffix):
syslog/logrotate/DNS like format:
p-%Y%m%d-suffix = prefix-20110719-s p-%Y%m%d%H%M-suffix = prefix-201107191732-s p-%Y%m%d%H%M%S-suffix = prefix-20110719173216-s
pros:
- It's "common", so "good enough" might be better than "best".
- No weird characters.
- Easy to distinguish the "date/time blob" from everything else.
cons:
- The date only version isn't easy to read, and including the time makes my eyes bleed and seconds as well is just "lol".
- Assumes TZ.
ISO-8601- format
p-%Y-%m-%d-s = p-2011-07-19-s p-%Y-%m-%dT%H:%M%z-s = p-2011-07-19T17:32-0400-s p-%Y-%m-%dT%H:%M:%S%z-s = p-2011-07-19T17:32:16-0400-s p-%Y-%m-%dT%H:%M:%S%z-s = p-2011-07-19T23:32:16+0200-s
pros:
- No spaces.
- Takes TZ into account.
- Is "not bad" to read by humans (date only is v. good).
- Can be generated by $(date --iso={hours,minutes,seconds})
cons:
- scp/tar/etc. won't like those ':' characters.
- Takes a bit for "normal" people to see WTF that 'T' is for, and what the thing at the end is :).
- Lots of '-' characters.
rfc-3339 format
p-%Y-%m-%d-s = p-2011-07-19-s p-%Y-%m-%d %H:%M%:z-s = p-2011-07-19 17:32-04:00-s p-%Y-%m-%d %H:%M:%S%:z-s = p-2011-07-19 17:32:16-04:00-s p-%Y-%m-%d %H:%M:%S%:z-s = p-2011-07-19 23:32:16+02:00-s
pros:
- Takes TZ into account.
- Can easily be read by "all humans".
- Can distinguish date/time from prefix/suffix.
- Some of the above can be generated with $(date --iso={hours,seconds})
cons:
- Has spaces in the time versions (which means all code will hate it).
- scp/tar/etc. won't like those ':' characters.
I love hyphens:
p-%Y-%m-%d-s = p-2011-07-19-s p-%Y-%m-%d-%H-%M-s = p-2011-07-19-17-32-s p-%Y-%m-%d-%H-%M-%S-s = p-2011-07-19-23-32-16-s
pros:
- basically a slightly nicer syslog/etc. variant.
cons:
- Lots of '-' characters.
- Assumes TZ.
I love hyphens, with extensions:
p.%Y-%m-%d.s = p.2011-07-19.s p.%Y-%m-%d.%H-%M.s = p.2011-07-19.17-32.s p.%Y-%m-%d.%H-%M-%S.s = p.2011-07-19.23-32-16.s
pros:
- basically a slightly nicer "I love hyphens" variant.
- No weird characters.
- Can distinguish date/time from prefix/suffix.
cons:
- Using '.' here is somewhat non-traditional.
- Assumes TZ.
...so anyone want to give a preference and a reason, or more than one (Eg. don't care about TZ if it's 95+% to stay machine local, but care a lot if it isn't).
Or, obviously, something not in the above list.
So...sample 'best' date-time formats:
20120317T1748Z
2012-03-17T1748Z
2012-03-17--1748Z
I am partial to 1. since it is fully IAW the standard, but the others are close.
Note:: Add seconds as necessary, of course. ...and yes, with or without seconds (or even minutes) is all IAW ISO 8601. :)
I would not include a time zone, only use universal time. If there may be confusion, you could add a -UTC suffix. If you specify a time zone, someone may depend on it. And there would be weird edge cases where DST changes or DST shifts wreak havoc on some processing, or processing is different on some systems because their DST configuration is not up to date. UTC is always the same everywhere.
I do think that hyphens make the file name more readable, in the sense that it makes it easier to discern the datetime of the file data. If you want to include sub-second precision, that usually is .nnnnn.
I personally don't like the T. Using a colon in a file name may affect interoperability with other file systems.
For whatever it's worth, this is the format that the screenshot utility
scrot
uses by default for the filename (i.e.: when no filename is specified):The parts using
%
are the standardstrftime(3)
format specifiers,$w
is the image width and$h
is the image height.Example:
For UTC timestamps:
Note: The timezone is not specified in the filename. Considering the tool's intended purpose (i.e.: screenshots), I do not think that it would add any value. Furthermore, I find the format above easy enough both to read and to parse as it is.
Source:
No separator between components makes it look like random numbers or just a huge counter.
Colon is a killer as it cannot be used on Windows systems (and thus also not on a mounted SMB share which sometimes is the only network protocol avaiable) and has unexpected side effects on macOS despite being a UNIX system: the file system is fine with colon but Finder displays it as forward slash (
/
) - this has historical reasons (historical colon was used as a path component separator on Mac and thus to make all paths look the same in macOS the system would map colon to slash; nice side effect, you can use use slashes in file names, as those are mapped to colons).All dashes is confusing as well.
For time you can use underscore, period, comma or percent (all filesystems allow percent and it has no meaning in bash/sh/zsh on its own, it is only ugly in URLs as it requires escaping). None of these require escaping on shell. Or you can use semicolon which is closest to a colon but requires escaping on shell.
And the convention almost everyone follows is "If there is no timezone written, it is UTC" and generally keeping all times always in UTC makes it easier to work with them. If required, it is always possible to convert them to local timestamps.
I too wouldn't include timezones. Your scripts/tools which process the logs should know about that. Also in regard of summer/winter time changes - I'd recommend to keep your server always fixed at UTC all the time. A sudden difference between the base server timezone and an (unchanged) timezone of a database running on it may lead to headaches ;-).
Regarding log file naming - I know, many don't like it, but I like to keep it simple:
p-%s-type.log = p-1311116459-type.log
pros:
cons:
On machines where colleagues (for whatever reason) need to check logs manually I went for this variant, rotating daily:
p-%Y-%m-%d-type.log = p-2011-07-20-type.log
Best regards