On Wed, 17 Jun 2015, Andrew Couzens wrote:
David,Debug line with all properties: FROMHOST: 'testhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'testhost', PRI: 134, syslogtag 'test:', programname: 'test', APP-NAME: 'test', PROCID: '-', MSGID: '-', TIMESTAMP: 'Jun 17 11:47:40', STRUCTURED-DATA: '-', msg: ' TEST' escaped msg: ' TEST' inputname: imuxsock rawmsg: '<134>Jun 17 14:47:40 test: TEST' The timestamp is there as you can see in the rawmsg but not being imported as the timestamp.
well, it's a little hard to tell, but is the time supposed to be provided by the application when writing to /dev/log? or is it just supposed to be '<pri> syslogtag: message'?
looking at the documentation: http://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html
Application-provided timestamps are ignored by default. This is needed, as some programs (e.g. sshd) log with inconsistent timezone information, what messes up the local logs (which by default don’t even contain time zone information). This seems to be consistent with what sysklogd did for the past four years. Alternate behaviour may be desirable if gateway-like processes send messages via the local log slot - in this case, it can be enabled via the IgnoreTimestamp and SysSock.IgnoreTimestamp config directives
David Lang
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
