Hello, I need some clarification about the timegenerated property. If I understand well the difference between timegenerated and timereported, timegenerated returns the time at which the message actually hits Rsyslog for the first time while timereported stores the time at which the log message has been generated by some software (let's say postfix for example).
If I have the following use case where all logging is local and I run logger "xxx" at time T, but Rsyslog receives it 10 seconds later (for whatever reason), I should get timereported = T and timegenerated = T + 10 seconds, is that correct ? Now if complexify my use case a bit, I get a local server which forwards its logs to a different machine in a different timezone. In that case what will timegenerated look like ? Will it contain the time the log message hits my local Rsyslog, or will it contain the time at which the log message hits my distant Rsyslog ? A (somewhat) related question : I found no property to get the current system timestamp in the documentation, there is indeed $now/$year etc but nothing with enough precision and which supports a transformation to an RFC339 compatible date (unlike timegenerated and timereported). Thanks in advance for your feedback. Best Regards, (I agree I could test this behaviour by myself and I already did but I get very strange results, hence my question) -- Jérôme _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
