Hello,
I did a test using %timereported% in a rsyslog running on a server,
to see if the time of a syslog msg sent from a unit was shown using
the local time of the unit and not the time it was received.
To easily see the difference I out the time 2 hours back on the
unit. The unit is running syslogd. That is, the original syslogd,
not the ng.
The unit running ran syslogd with the following in its
configuration:
*.* @10.200.19.162
The logger utility was used to create log msgs locally on the unit.
These log msgs are then sent to rsyslog on the remote server.
The workstation was running rsyslog with either:
#$template precise,"%timereported% from: %HOSTNAME% %syslogtag%:%msg%\n"
$template precise,"%TIMESTAMP% from: %HOSTNAME% %syslogtag%:%msg%\n"
And tests were done with the following commented or not:
$ActionFileDefaultTemplate precise
(I am not sure if the 'precise' template definition must be used
with $ActionFileDefaultTemplate to take effect)
The following was then found on the unit after executing the logger
utility:
Feb 27 10:55:34 localhost syslogd 1.4.1#18RR6: restart.
Feb 27 10:55:35 localhost kernel: klogd 1.4.1#18RR6, log source =
/proc/kmsg started.
Feb 27 10:55:44 localhost root: TEST7
And these messages were received by rsyslog (after restarting
rsyslog to have its version info included here) :
Feb 27 12:52:32 from: localhost rsyslogd:: [origin software="rsyslogd"
swVersion="3.22.1" x-pid="6909" x-info="http://www.rsyslog.com";]
(re)start
Feb 27 12:54:38 from: syslogd 1.4.1#18RR6:: restart.
Feb 27 12:54:39 from: brouter kernel:: klogd 1.4.1#18RR6, log source =
/proc/kmsg started.
Feb 27 12:54:48 from: brouter root:: TEST7
The TEST7 msg did now show the unit's time.
Now, I installed rsyslog at the unit as a drop-in syslog replacement
w/o any configuration change and when rsyslog is used, the local unit
time is received and shown by the server.
Can we presume that syslogd first generation does not send the time
to a remote syslogging facility ?
Regards,
Al
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
