[opensuse] rsyslog timestamp question
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, In my small home server I use rsyslog to write to log file the entries sent by other small machines in the house, such as router. I have just put into service a new WiFi access point. The entry in rsyslog.conf is: if ($source == '192.168.1.7') or ($source == 'ap') or ($source == 'ap.valinor') then \ -/var/log/router & stop and I get with that: <3.4> 2016-10-20T21:13:41+02:00 router kernel - - - [skip] w:eth0.3 l:eth4 dev:br0 <3.6> 2016-10-20T21:13:41+02:00 router kernel - - - br0: port 1(eth4) entering forwarding state <1.6> 2016-01-01T01:00:10+02:00 ap.valinor kernel - - - br0: port 2(eth1) entering forwarding state <1.6> 2016-01-01T01:00:10+02:00 ap.valinor kernel - - - br0: topology change detected, propagating <1.6> 2016-01-01T01:00:10+02:00 ap.valinor kernel - - - br0: port 1(vlan0) entering forwarding state <1.0> 2016-01-01T01:00:10+02:00 ap.valinor ntp - - - start NTP update The first two lines belong to the ISP router, left there for reference. The other four belong to the AP. Notice the timestamp? Obviously it is writing the time sent by the device, before it runs the NTP query, and thus the time is incorrect. How could I log a timestamp written by the rsyslog server machine? - -- Cheers Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlgJKw0ACgkQtTMYHG2NR9WBoACgh20NGGB+QnBrsKI4wTEAqGqj NhoAnAxZ656yZGTCMcnOdNyj47CGuPW0 =XvHv -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 2016-10-20 22:37, Carlos E. R. wrote:
How could I log a timestamp written by the rsyslog server machine?
Solved, thanks to an offlist reply. I need %timegenerated%. In this case: $template My_SyslogProtocolExt,"<%SYSLOGFACILITY%.%SYSLOGPRIORITY%> %timegenerated:::date-rfc3339% %TIMESTAMP:::date-rfc3339% %HOSTNAME% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg%\n" if ($source == 'router') then \ -/var/log/router;My_SyslogProtocolExt & stop So I get entries like this: <1.6> 2016-10-21T12:13:22.049600+02:00 2016-08-01T02:00:09+02:00 ap.valinor kernel - - - br0: port 2(eth1) entering forwarding state -- Cheers / Saludos, Carlos E. R. (from 13.1 x86_64 "Bottle" at Telcontar)
participants (1)
-
Carlos E. R.