On Fri, 26 Feb 2010, lanas wrote: > On Thu, 25 Feb 2010 23:46:21 -0800 (PST), > [email protected] wrote : > >> On Thu, 25 Feb 2010, lanas wrote: >>> Is it possible with rsyslog to somehow send the time of the local >>> event as part of the log message when sending to a remote server ? >> >> each event has two timestamps, one is the timestamp in the message >> that was sent, the other is the time the message was received. I >> believe that the default template uses the recieved timestamp, but >> you can change it to timereportedto get the timestamp put on the >> message by the sender. > > Thanks, I will try it. Basically, this means that (if there's a syslog > message standard ...) that syslog messages contains both timestamps, be > them generated by syslogd or rsyslog, isn't it ? And it's at the > receiving side that the proper display option should be chosen (in this > case, does rsyslog have an advantage over others by providing more > display options ?).
the messages sent over the wire only have one timestamp in them, but when rsyslog receives a message it records that time as well. This gives rsyslog the option of using either timestamp when it then writes (or sends) the log. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
