Hi Radu, Thanks for your feedback :)
On Tue, Dec 4, 2012 at 11:33 AM, Radu Gheorghe <[email protected]> wrote: [...] > > >> >> Now if complexify my use case a bit, I get a local server which >> forwards its logs to a different machine in a different timezone. >> In that case what will timegenerated look like ? Will it contain the >> time the log message hits my local Rsyslog, or will it contain the >> time at which the log message hits my distant Rsyslog ? >> > > My understanding is that the property applies to the template that is > applied. So if you have a template in your distant Rsyslog that writes your > timegenerated to a file, then timegenerated will be the system time of that > Rsyslog when the log was received. Or actually, when the log is parsed. > You are right, if would have been surprising if it was the contrary and I just did a couple of tests to confirm this behavior. (The strange behavior I got this morning was due to a mistake from my side.) Am I the only one to find the documentation about time(generated|reported) misleading ? Would not "timereceived" and "timereported" be clearer ? -- Jérôme _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
