Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to configure our rsyslog server to drop the timestamp of the incoming messages and replace them with time from the rsyslog server.

Reason for this is that we have some system that don't have the option to change the time on their logging entrys.

Our rsyslog-server is running with: Red Hat Enterprise Linux Server release 6.3 (Santiago)

For Example the syslog-ng OSE can do something like that: it's called keep_timestamp():

"setting the keep-timestamp() option to no allows syslog-ng OSE to replace the full timestamp (timezone included) with the time the message was received".

That's what i need for my rsyslog server, hope that clarifies what i am looking for.

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

On your receiving rsyslog server, add the following template line to /etc/syslog.conf

$template myFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"

$ActionFileDefaultTemplate myFormat

The %timegenerated% properly is what you are asking for. From man page

timegenerated timestamp when the message was RECEIVED. Always in high resolution

You can see all option with man rsyslog.conf.

share|improve this answer
    
not what i had in mind, but it works just as well, thanks ;-) –  cptPH Jan 16 '13 at 13:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.