0

I was curious if anyone has sorted incoming logs captured by Rsyslog by hostname and time stamp in the log.

Right now I have Rsyslog sort messages by the hostname moving them to appropriate folders and then Logrotate set to daily. My concern is if logs come in after logrotation that have a timestamp for the previous day. Since not all the servers times are in sync I figured this could cause some confusion if I ever need to search the logs and the file name is not 100% the correct date for the logs inside.

Any help?

Cheers

cabotek
  • 1
  • 1

1 Answers1

0

make sure you are using ntp to sync the time.If not try to use Message Property Variables These are items derived from the message or the connection information, such as the timestamp within the message, the timestamp when the message was received on the local system, the hostname in the message, the hostname/IP of the system that delivered the message to the local box, PRI info, etc.For rsyslog version 5 and earlier, these were the only variables available.

So try using receiving time variable rather then timestamp to make sure this problem never happens.

> $template TEMPLATE_NAME,"%timegenerated:::date-rfc3339% %fromhost% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
Amrit Pal Singh
  • 16
  • 3
  • I have a separate conf file under the rsyslog.d/ directory. In the file I have the below format. " if $hostname == 'test-server' then /mnt/logs/test-server.log & stop " Is it possible to use your format in there? – cabotek Aug 29 '20 at 04:27
  • @cabotek the above mentioned format need to be defined to rsysconf which will be implemented globally for all the file formats within the server. – Amrit Pal Singh Aug 29 '20 at 17:00