[rsyslog] Sending time in remote syslog

[david at lang.hm]

On Thu, 25 Feb 2010, lanas wrote:

> Hello !
>
>  Is it possible with rsyslog to somehow send the time of the local
> event as part of the log message when sending to a remote server ?
>
>  Here's a use case. I have tried with syslogd.  I enable syslogd on a
> unit to send log messages to a remote host running rsyslog (it so
> happens that it runs rsyslog because it's a Fedora host).  Then I
> change the time on the unit by an offset of two hours.  When the unit
> (syslogd) sends the log message, it is received by rsyslogd although
> the time stamp in the log msg shows the time on the host, not the time
> when the event happened on the unit itself.
>
>  If I replace syslogd by rsyslog on the unit, will it be able to
> somehow send the local time of the unit as part of the log message ?

each event has two timestamps, one is the timestamp in the message that 
was sent, the other is the time the message was received. I believe that 
the default template uses the recieved timestamp, but you can change it to 
timereportedto get the timestamp put on the message by the sender.

David Lang