ping, now that we are both back from vacation, can you take a quick look at
this?
David Lang
On Thu, 25 Jul 2013, Rainer Gerhards wrote:
Date: Thu, 25 Jul 2013 16:56:33 +0200
From: Rainer Gerhards <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] date format question
Need to look at this :(
Sent from phone, thus brief.
Am 25.07.2013 02:25 schrieb "David Lang" <[email protected]>:
I have the following in a config
set $!trusted!edge!time = $timegenerated;
and the timegenerated property is documented to always be a high-res
timestamp
however, what I'm getting in the resulting log (as part of $! output) is
the short rfc3164 timestamp format
input is 'logger testtest'
$template structured_forwarding,"<%pri%>**%timereported% %hostname%
%syslogtag% %$!%\n"
resulting log message is:
<13>Jul 24 21:51:42 app-server dlang: { "msg": "testtest", "trusted": {
"origserver": "10.1.2.9", "edge": { "time": "Jul 24 14:51:42", "relay":
"dlang-desktop2", "input": "imudp" }, "environment": "sending network" } }
This is 7.5.2 from the adiscon hosted packages.
full rsyslog.conf file:
module(load="imuxsock" SysSock.Annotate="on" SysSock.ParseTrusted="on")
module(load="imklog")
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp" MaxSessions="1000")
input(type="imtcp" port="514")
module(load="mmjsonparse")
module(load="omrelp")
action(type="mmjsonparse")
if $fromhost-ip != "127.0.0.1" then {
set $!trusted!origserver = $fromhost-ip;
set $!trusted!edge!time = $timegenerated;
set $!trusted!edge!relay = $$myhostname;
set $!trusted!edge!input = $inputname;
} else {
set $!trusted!local!input = $inputname;
}
set $!trusted!environment = "sending network"; # this should be replaced
with a lookup table call when that feature is added.
$template structured_forwarding,"<%pri%>**%%timereported:rfc3339%
%hostname% %syslogtag% %$!%\n"
/var/log/messages;structured_**forwarding
David Lang
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
