On Thu, 18 Jun 2015, Andrew Couzens wrote: <snip>
I'm not sure what the procedure is for local logging, but for what its worth I've been using syslog-ng 2.1.x which uses the timestamp provided in the rawmsg which is the behaviour i'm looking to get out of rsyslog.
<snip>
I was hoping the date-rfc3339 tag would format the date found in that section of the rawmsg but it doesn't appear to work. Perhaps that is only valid with the %timestamp% macros. Is there any way to get the date converted to the rfc3339 format?
Please read the documentation page I link to below. The paragraph I quote explains how the timestamp is ignored by default for messages received via /dev/log, and the rest of the page includes information on how to turn this off so that timestamps will not be ignored.
David Lang
well, it's a little hard to tell, but is the time supposed to be provided by the application when writing to /dev/log? or is it just supposed to be '<pri> syslogtag: message'? looking at the documentation: http://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html Application-provided timestamps are ignored by default. This is needed, as some programs (e.g. sshd) log with inconsistent timezone information, what messes up the local logs (which by default don’t even contain time zone information). This seems to be consistent with what sysklogd did for the past four years. Alternate behaviour may be desirable if gateway-like processes send messages via the local log slot - in this case, it can be enabled via the IgnoreTimestamp and SysSock.IgnoreTimestamp config directives David Lang_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
