2015-06-18 8:38 GMT+02:00 David Lang <[email protected]>: > On Wed, 17 Jun 2015, Andrew Couzens wrote: > >> David, >> >> Debug line with all properties: >> FROMHOST: 'testhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'testhost', PRI: >> 134, >> syslogtag 'test:', programname: 'test', APP-NAME: 'test', PROCID: '-', >> MSGID: '-', >> TIMESTAMP: 'Jun 17 11:47:40', STRUCTURED-DATA: '-', >> msg: ' TEST' >> escaped msg: ' TEST' >> inputname: imuxsock rawmsg: '<134>Jun 17 14:47:40 test: TEST' >> >> The timestamp is there as you can see in the rawmsg but not being imported >> as the timestamp. > > > well, it's a little hard to tell, but is the time supposed to be provided by > the application when writing to /dev/log? or is it just supposed to be > '<pri> syslogtag: message'? > > looking at the documentation: > http://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html > > Application-provided timestamps are ignored by default. This is needed, as > some programs (e.g. sshd) log with inconsistent timezone information, what > messes up the local logs (which by default don’t even contain time zone > information). This seems to be consistent with what sysklogd did for the > past four years. Alternate behaviour may be desirable if gateway-like > processes send messages via the local log slot - in this case, it can be > enabled via the IgnoreTimestamp and SysSock.IgnoreTimestamp config > directives
Is this message from the local log socket? I thought it was network-received (full configs are *very useful* to post...). Anyhow, I would suggest to upgrade to the currently supported 8.10 and then see if the problem persists. I know we had quite some changes back and forth in the dark ages of v5 in regard to timestamp processing. But the details I have long forgotten... Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
