Hi Jerome, 2012/12/4 Jerome Renard <[email protected]>
> Hello, > > I need some clarification about the timegenerated property. If I > understand well the difference between timegenerated and timereported, > timegenerated returns the time at which the message actually hits > Rsyslog for the first time while timereported stores the time at which > the log message has been generated by some software (let's say postfix > for example). > > If I have the following use case where all logging is local and I run > logger "xxx" at time T, but Rsyslog receives it 10 seconds later (for > whatever reason), I should get timereported = T and timegenerated = T > + 10 seconds, is that correct ? > That's my understanding as well. > > Now if complexify my use case a bit, I get a local server which > forwards its logs to a different machine in a different timezone. > In that case what will timegenerated look like ? Will it contain the > time the log message hits my local Rsyslog, or will it contain the > time at which the log message hits my distant Rsyslog ? > My understanding is that the property applies to the template that is applied. So if you have a template in your distant Rsyslog that writes your timegenerated to a file, then timegenerated will be the system time of that Rsyslog when the log was received. Or actually, when the log is parsed. Best regards, Radu > > A (somewhat) related question : I found no property to get the current > system timestamp in the documentation, there is indeed $now/$year etc > but nothing with enough precision and which supports a transformation > to an RFC339 compatible date (unlike timegenerated and timereported). > > Thanks in advance for your feedback. > > Best Regards, > > (I agree I could test this behaviour by myself and I already did but I > get very strange results, hence my question) > > -- > Jérôme > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
