timegenerated - timestamp when the message was RECEIVED. Always in high resolution timereported - timestamp from the message. Resolution depends on what was provided in the message (in most cases, only seconds)
Neither of these fit into either a mysql datetime nor unixtime field type! They come in the format "Oct 19 12:32:54", exacly what is high resolution about that I don't know. So, does rsyslog provide a way to easily fit these into a time-aware mysql field type? My template looks like this: $template SyslogAllInsert,"INSERT INTO `Syslog`.`AllMessages` (`ID` ,`timeGenerated` ,`timeReported` ,`source` ,`programName` ,`syslogTag` ,`syslogFacility` ,`syslogSeverity` ,`message`)VALUES ( NULL , '%timegenerated%', '%timereported%', '%source%', '%programname%', '%syslogtag%', '%syslogfacility%', '%syslogseverity%', '%msg%');",sql TIA Cheers, Stian Øvrevåge _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
