4

I would like to configure our rsyslog server to drop the timestamp of the incoming messages and replace them with time from the rsyslog server.

Reason for this is that we have some system that don't have the option to change the time on their logging entrys.

Our rsyslog-server is running with: Red Hat Enterprise Linux Server release 6.3 (Santiago)

For Example the syslog-ng OSE can do something like that: it's called keep_timestamp():

"setting the keep-timestamp() option to no allows syslog-ng OSE to replace the full timestamp (timezone included) with the time the message was received".

That's what i need for my rsyslog server, hope that clarifies what i am looking for.

1 Answer 1

3

On your receiving rsyslog server, add the following template line to /etc/syslog.conf

$template myFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"

$ActionFileDefaultTemplate myFormat

The %timegenerated% properly is what you are asking for. From man page

timegenerated timestamp when the message was RECEIVED. Always in high resolution

You can see all option with man rsyslog.conf.

1
  • not what i had in mind, but it works just as well, thanks ;-)
    – cptPH
    Jan 16, 2013 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .