David, Sorry to make you repeat yourself. I originally assumed that looking at the v8 documentation wouldn't be helpful since I'm working with v5.
I found success with the option: $SystemLogSocketIgnoreMsgTimestamp off so thank you very much for your help. Andrew ________________________________________ From: [email protected] [[email protected]] on behalf of David Lang [[email protected]] Sent: Thursday, June 18, 2015 10:20 PM To: rsyslog-users Subject: Re: [rsyslog] rsyslog 5: retaining timestamp provided in message On Thu, 18 Jun 2015, Andrew Couzens wrote: <snip> > I'm not sure what the procedure is for local logging, but for what its worth > I've been using syslog-ng 2.1.x which uses the timestamp provided in the > rawmsg which is the behaviour i'm looking to get out of rsyslog. <snip> > I was hoping the date-rfc3339 tag would format the date found in that section > of the rawmsg but it doesn't appear to work. Perhaps that is only valid with > the %timestamp% macros. Is there any way to get the date converted to the > rfc3339 format? Please read the documentation page I link to below. The paragraph I quote explains how the timestamp is ignored by default for messages received via /dev/log, and the rest of the page includes information on how to turn this off so that timestamps will not be ignored. David Lang >> well, it's a little hard to tell, but is the time supposed to be provided by >> the >> application when writing to /dev/log? or is it just supposed to be '<pri> >> syslogtag: message'? >> >> looking at the documentation: >> http://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html >> >> Application-provided timestamps are ignored by default. This is needed, as >> some >> programs (e.g. sshd) log with inconsistent timezone information, what messes >> up >> the local logs (which by default don’t even contain time zone information). >> This >> seems to be consistent with what sysklogd did for the past four years. >> Alternate >> behaviour may be desirable if gateway-like processes send messages via the >> local >> log slot - in this case, it can be enabled via the IgnoreTimestamp and >> SysSock.IgnoreTimestamp config directives >> >> David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
