[rsyslog] Sending time in remote syslog

[david at lang.hm]

On Fri, 26 Feb 2010, lanas wrote:

> On Thu, 25 Feb 2010 23:46:21 -0800 (PST),
> david at lang.hm wrote :
>
>> On Thu, 25 Feb 2010, lanas wrote:
>>>  Is it possible with rsyslog to somehow send the time of the local
>>> event as part of the log message when sending to a remote server ?
>>
>> each event has two timestamps, one is the timestamp in the message
>> that was sent, the other is the time the message was received. I
>> believe that the default template uses the recieved timestamp, but
>> you can change it to timereportedto get the timestamp put on the
>> message by the sender.
>
> Thanks, I will try it.  Basically, this means that (if there's a syslog
> message standard ...) that syslog messages contains both timestamps, be
> them generated by syslogd or rsyslog, isn't it ?  And it's at the
> receiving side that the proper display option should be chosen (in this
> case, does rsyslog have an advantage over others by providing more
> display options ?).

the messages sent over the wire only have one timestamp in them, but when 
rsyslog receives a message it records that time as well. This gives 
rsyslog the option of using either timestamp when it then writes (or 
sends) the log.

David Lang