On Mon, Oct 24, 2011 at 10:23:49PM -0700, [email protected] wrote: > it looks to me like rsyslog is not recognizing the timestamp, > probably due to the decimal seconds. > > could you post the rawlog of the message?
Example message: $template hostorip,"%TIMESTAMP:1:23:date-rfc3339% %fromhost% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n 2011-10-25T07:31:21.731 frnk1-bras1 25 07:31:21.742: [0001]: %LDP-6-INFO: ldp_rcv_notify: 172.30.0.2 rcv NOTIFICATION, 18 bytes, status data 0x9(Hold Timer Expired),fatal bit 1, forwar bit 0 $template raw,"%rawmsg%\n" <190>Oct 25 07:31:21.742: [0001]: %LDP-6-INFO: ldp_rcv_notify: 172.30.0.2 rcv NOTIFICATION, 18 bytes, status data 0x9(Hold Timer Expired),fatal bit 1, forwar bit 0 Flo -- Florian Lohoff [email protected]
signature.asc
Description: Digital signature
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
