Hello, While I don't know a direct answer to your question, here are a few suggestions that might help: - use the "timegenerated" property to name the files, so you'll have the time zone of the machine that gets the logs - get the timezone included in the log's timestamp, by either using RFC5424 (RSYSLOG_SyslogProtocol23Format template) or by putting the ISO timestamp in the RFC3164-formatted log (RSYSLOG_ForwardFormat tempate). Then, I'm not sure how you can write the files so they use UTC with macros like "$hour", but I'd test and see. Ultimately, you can try using the "unixtimestamp" format and maybe generate the file names from there.
2013/9/4 Chastity Blackwell <[email protected]> > Working further on my templates for dynamic logfile naming, I'd like to > name our log archives after the time in UTC (which is unfortunately not > the current system time at the moment) instead of their local time zone. > Is there a good way to do this that will not cause undue overhead? Our > application is pretty high volume, and I'm worried that doing a lot of > scripting to figure out the times will not be a good thing for the > processing rate. Can I use /etc/default to tell rsyslog what time zone > to use or something similar? > > Just to clarify what I'm looking for, during 0900-0915 of 4 Sept 2013 > PDT, I'd like files to go in: > > /logs/events/2013_09/04/event-2013-09-04-16-00.gz > > (because 0900 PDT is 1600 GMT) > > If this isn't possible it's not the end of the world for me, but it > would be convenient -- our biggest concern right now is what happens > during the end of DST in November. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
