you can use $template raw,"%rawmsg%\n"
to see exactly what the remote box sends. If I recall correctly, sysklogd sends timestamps, but I may be wrong Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of lanas > Sent: Tuesday, March 02, 2010 2:44 AM > To: [email protected] > Subject: [rsyslog] Sending time in remote syslog - test > > Hello, > > I did a test using %timereported% in a rsyslog running on a server, > to see if the time of a syslog msg sent from a unit was shown using > the local time of the unit and not the time it was received. > > To easily see the difference I out the time 2 hours back on the > unit. The unit is running syslogd. That is, the original syslogd, > not the ng. > > The unit running ran syslogd with the following in its > configuration: > > *.* @10.200.19.162 > > The logger utility was used to create log msgs locally on the unit. > These log msgs are then sent to rsyslog on the remote server. > > The workstation was running rsyslog with either: > > #$template precise,"%timereported% from: %HOSTNAME% > %syslogtag%:%msg%\n" > $template precise,"%TIMESTAMP% from: %HOSTNAME% %syslogtag%:%msg%\n" > > And tests were done with the following commented or not: > > $ActionFileDefaultTemplate precise > > (I am not sure if the 'precise' template definition must be used > with $ActionFileDefaultTemplate to take effect) > > The following was then found on the unit after executing the logger > utility: > > Feb 27 10:55:34 localhost syslogd 1.4.1#18RR6: restart. > Feb 27 10:55:35 localhost kernel: klogd 1.4.1#18RR6, log source = > /proc/kmsg started. > Feb 27 10:55:44 localhost root: TEST7 > > And these messages were received by rsyslog (after restarting > rsyslog to have its version info included here) : > > Feb 27 12:52:32 from: localhost rsyslogd:: [origin software="rsyslogd" > swVersion="3.22.1" x-pid="6909" x-info="http://www.rsyslog.com";] > (re)start > Feb 27 12:54:38 from: syslogd 1.4.1#18RR6:: restart. > Feb 27 12:54:39 from: brouter kernel:: klogd 1.4.1#18RR6, log source = > /proc/kmsg started. > Feb 27 12:54:48 from: brouter root:: TEST7 > > The TEST7 msg did now show the unit's time. > > Now, I installed rsyslog at the unit as a drop-in syslog replacement > w/o any configuration change and when rsyslog is used, the local unit > time is received and shown by the server. > > Can we presume that syslogd first generation does not send the time > to a remote syslogging facility ? > > Regards, > > Al > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
