Mailing List Archive

rsyslog Timezone?
Hi,



im trying to set a CEST Timezon ion rsyslog generally,

so the logs are on all Servers are in the same TZ,

also when the local System Time is set to another TZ.



In the config i have:



timezone(id="UTC" offset="+00:00")

$template mytime,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"

$ActionFileDefaultTemplate mytime



But it wont work, it always use the Local System Time.



The rsyslog Version is: 8.1901.0-1 (Debian 10)



Wilhelm



_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog Timezone? [ In reply to ]
where did you find documentation on the timezone() parameter?

David Lang
On Tue, 3 Nov 2020, Wilhelm Greiner via rsyslog wrote:

> Date: Tue, 3 Nov 2020 16:46:49 +0100
> From: Wilhelm Greiner via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Wilhelm Greiner <wilhelm.greiner@erwo.net>
> Subject: [rsyslog] rsyslog Timezone?
>
> Hi,
>
>
>
> im trying to set a CEST Timezon ion rsyslog generally,
>
> so the logs are on all Servers are in the same TZ,
>
> also when the local System Time is set to another TZ.
>
>
>
> In the config i have:
>
>
>
> timezone(id="UTC" offset="+00:00")
>
> $template mytime,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
>
> $ActionFileDefaultTemplate mytime
>
>
>
> But it wont work, it always use the Local System Time.
>
>
>
> The rsyslog Version is: 8.1901.0-1 (Debian 10)
>
>
>
> Wilhelm
>
>
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog Timezone? [ In reply to ]
It's here: https://www.rsyslog.com/doc/v8-stable/configuration/timezone.html

But I think we need to see the config of the OP.

Rainer

El mié., 4 nov. 2020 a las 5:57, David Lang via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> where did you find documentation on the timezone() parameter?
>
> David Lang
> On Tue, 3 Nov 2020, Wilhelm Greiner via rsyslog wrote:
>
> > Date: Tue, 3 Nov 2020 16:46:49 +0100
> > From: Wilhelm Greiner via rsyslog <rsyslog@lists.adiscon.com>
> > To: rsyslog@lists.adiscon.com
> > Cc: Wilhelm Greiner <wilhelm.greiner@erwo.net>
> > Subject: [rsyslog] rsyslog Timezone?
> >
> > Hi,
> >
> >
> >
> > im trying to set a CEST Timezon ion rsyslog generally,
> >
> > so the logs are on all Servers are in the same TZ,
> >
> > also when the local System Time is set to another TZ.
> >
> >
> >
> > In the config i have:
> >
> >
> >
> > timezone(id="UTC" offset="+00:00")
> >
> > $template mytime,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
> >
> > $ActionFileDefaultTemplate mytime
> >
> >
> >
> > But it wont work, it always use the Local System Time.
> >
> >
> >
> > The rsyslog Version is: 8.1901.0-1 (Debian 10)
> >
> >
> >
> > Wilhelm
> >
> >
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog Timezone? [ In reply to ]
Hi,

it ist the debian standard config, just addet these Lines.

But the config is here:
http://erwo.net/tmp/rsyslog.conf

On Debian 10

Wilhelm Greiner

-----Ursprüngliche Nachricht-----
Von: rsyslog [mailto:rsyslog-bounces@lists.adiscon.com] Im Auftrag von Rainer Gerhards via rsyslog
Gesendet: Mittwoch, 4. November 2020 09:14
An: rsyslog-users <rsyslog@lists.adiscon.com>
Cc: Rainer Gerhards <rgerhards@hq.adiscon.com>
Betreff: Re: [rsyslog] rsyslog Timezone?

It's here: https://www.rsyslog.com/doc/v8-stable/configuration/timezone.html

But I think we need to see the config of the OP.

Rainer

El mié., 4 nov. 2020 a las 5:57, David Lang via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> where did you find documentation on the timezone() parameter?
>
> David Lang
> On Tue, 3 Nov 2020, Wilhelm Greiner via rsyslog wrote:
>
> > Date: Tue, 3 Nov 2020 16:46:49 +0100
> > From: Wilhelm Greiner via rsyslog <rsyslog@lists.adiscon.com>
> > To: rsyslog@lists.adiscon.com
> > Cc: Wilhelm Greiner <wilhelm.greiner@erwo.net>
> > Subject: [rsyslog] rsyslog Timezone?
> >
> > Hi,
> >
> >
> >
> > im trying to set a CEST Timezon ion rsyslog generally,
> >
> > so the logs are on all Servers are in the same TZ,
> >
> > also when the local System Time is set to another TZ.
> >
> >
> >
> > In the config i have:
> >
> >
> >
> > timezone(id="UTC" offset="+00:00")
> >
> > $template mytime,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
> >
> > $ActionFileDefaultTemplate mytime
> >
> >
> >
> > But it wont work, it always use the Local System Time.
> >
> >
> >
> > The rsyslog Version is: 8.1901.0-1 (Debian 10)
> >
> >
> >
> > Wilhelm
> >
> >
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog Timezone? [ In reply to ]
so now the question is what does the timestamp inside the messages
look like? If they do not contain the string "CEST" at the correct
place, rsyslog cannot detect it and thus not apply the transformation.

Right at the top of the conf add

*.* /var/log/msgprops;RSYSLOG_DebugFormat

and let us know what the file contains. It shows, among other things,
the rawmessage.

Rainer

El mié., 4 nov. 2020 a las 9:22, Wilhelm Greiner via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hi,
>
> it ist the debian standard config, just addet these Lines.
>
> But the config is here:
> http://erwo.net/tmp/rsyslog.conf
>
> On Debian 10
>
> Wilhelm Greiner
>
> -----Ursprüngliche Nachricht-----
> Von: rsyslog [mailto:rsyslog-bounces@lists.adiscon.com] Im Auftrag von Rainer Gerhards via rsyslog
> Gesendet: Mittwoch, 4. November 2020 09:14
> An: rsyslog-users <rsyslog@lists.adiscon.com>
> Cc: Rainer Gerhards <rgerhards@hq.adiscon.com>
> Betreff: Re: [rsyslog] rsyslog Timezone?
>
> It's here: https://www.rsyslog.com/doc/v8-stable/configuration/timezone.html
>
> But I think we need to see the config of the OP.
>
> Rainer
>
> El mié., 4 nov. 2020 a las 5:57, David Lang via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
> >
> > where did you find documentation on the timezone() parameter?
> >
> > David Lang
> > On Tue, 3 Nov 2020, Wilhelm Greiner via rsyslog wrote:
> >
> > > Date: Tue, 3 Nov 2020 16:46:49 +0100
> > > From: Wilhelm Greiner via rsyslog <rsyslog@lists.adiscon.com>
> > > To: rsyslog@lists.adiscon.com
> > > Cc: Wilhelm Greiner <wilhelm.greiner@erwo.net>
> > > Subject: [rsyslog] rsyslog Timezone?
> > >
> > > Hi,
> > >
> > >
> > >
> > > im trying to set a CEST Timezon ion rsyslog generally,
> > >
> > > so the logs are on all Servers are in the same TZ,
> > >
> > > also when the local System Time is set to another TZ.
> > >
> > >
> > >
> > > In the config i have:
> > >
> > >
> > >
> > > timezone(id="UTC" offset="+00:00")
> > >
> > > $template mytime,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
> > >
> > > $ActionFileDefaultTemplate mytime
> > >
> > >
> > >
> > > But it wont work, it always use the Local System Time.
> > >
> > >
> > >
> > > The rsyslog Version is: 8.1901.0-1 (Debian 10)
> > >
> > >
> > >
> > > Wilhelm
> > >
> > >
> > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > >
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.