Anyway to change the rsyslog timestamp?

Primetime0 · 12-31-2014, 09:08 AM

Hi linux gurus,

I have setup an rsyslog remote logging server on ubuntu 14.04 based in the US east timezone. It accepts logs from servers in this region and some located in the UK. The problem is that it is recording the messages originating from the UK with a timestamp +5 hours.

Is there a simple way to change this behavior for the central logging server to record delivery time as opposed to recorded time? The caveat here is that I cannot adjust the timezone on the UK or US East servers.

Version of rsyslog is: 7.4.4

Habitual · 12-31-2014, 09:59 AM

What an interesting subject.

Welcome to LQ!

subscribed with interest.

http://www.rsyslog.com/doc/v7-stable...sesystimestamp
says:
"UseSysTimeStamp [on/off] instructs imuxsock to obtain message time from the system (via control messages) instead of using time recorded inside the message."...

Primetime0 · 01-08-2015, 09:48 AM

Quote:

Originally Posted by Habitual

What an interesting subject.

Welcome to LQ!

subscribed with interest.

http://www.rsyslog.com/doc/v7-stable...sesystimestamp
says:
"UseSysTimeStamp [on/off] instructs imuxsock to obtain message time from the system (via control messages) instead of using time recorded inside the message."...

Thanks Habitual and sorry for the late reply. I have tried applying the UseSysTimeStamp option for the imuxsock module. This does not seem to affect messages coming in via imtcp but I think you have put me on the right track. I have contacted adiscon support for any further information and will post their solution here once they get back to me.

Thanks again!

Habitual · 01-08-2015, 10:42 AM

Glad to be of help.
Happy New Year 2015!