MonitorWare Knowledge Base

Hi all,

I's running 3.20.2 and have 5 servers in different timezones logging to a central server in the UK (GMT).
I am not logging to mysql, I'm logging to flat file and am not wanting to use a front end like phplogcon.

The log times are totally off and I can't seem to find a setting in the conf file or a template to solve this problem.

Is there anything I can do?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

No info? Does it work if I compile relp into it? Any info appreciated...

Sorry, overlooked. To provide a real answer, I need to know how the raw message looks. Please provide the content of the %rawmsg% property.

Thanks,
Rainer

How do I get that?

The end result I need is that the servers with logs in MST time are sending to the GMT rsyslog collection server, but all timestamps are shown in GMT rather than the MST servers sending the data with MST timestamps thus throwing the times out of whack.

Is there anything I need to do THAT IS NOT in the default install to achieve this..

looking more into this, is there a way you can listen for a hostname and somehow add 7 hours to it's timestamp? That would solve my problem.

actually, I think I have solved it. I have not sent the timestamp of the messages from the client and the rsyslog server fills them in with the local time.
Job done.

OK, that explains it, simply because there is no way in which rsyslog could know the correct time zone (well... we could think about adding an option to modify the TZ of a sender, but that's a biggie )

rgerhards wrote:OK, that explains it, simply because there is no way in which rsyslog could know the correct time zone (well... we could think about adding an option to modify the TZ of a sender, but that's a biggie )

..really? I couldn't find it as a feature, however I was assured by the engineers above me that this is a fairly frequent request and so there must be a way to do it. Maybe later then, it's works as of now anyway..

well, it is easy to add the timezone at the sender, but it is far from easy to get the TZ right at the receiver (when no TZ info is inside the message)