M
M
Malissa2015-08-18 10:01:29
RSYSLOG
Malissa, 2015-08-18 10:01:29

How to change date and time in rsyslog?

We use rsyslog to receive logs from remote devices. In some connected devices, time synchronization does not work, as a result, incorrect time is poured into the logs.
At the moment, we use the breakdown of logs by source fromhost-ip:

$template FILENAME,"/var/log/%fromhost-ip%/syslog.log"
*.*       ?FILENAME

I would like the logs that get into the files to go with the substitution of time for server timegenerated We
tried to replace the standard template:
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
...
$template RSYSLOG_TraditionalFileFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"

but in the end everything remained the same, apparently they misunderstood what to do. can anyone suggest how to do it?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question