Hello:

I have several sources that are all reporting to a syslog-ng 2.0.3 server
My source is

source all_routers { udp(ip(0.0.0.0) port(514));
};

My problem is that I have one source that is isolated to a separate file

I isolate the file with the following
filter f_pd_snort { host(intsnort1); };

and have this destination
destination d_pd_snort  { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) template(t_default)); };

then i use the following command
log { source(all_routers); filter(f_pd_snort); destination(d_pd_snort); };

The problem is the format the data is arriving in. It send data in UTC time as follows
Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:13:1] Snort Alert [Classification: Unknown] [Priority: 3]
Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:4:1] Snort Alert [Classification: Unknown] [Priority: 3]
Apr 30 14:04:35 2007 intsnort1 SFIMS: [122:3:0] Snort Alert [Classification: Unknown] [Priority: 3]

This is UTC. It is the time that is being sent in the actual packet (I verified with wireshark)

I want syslog-ng to modify the times going into this file (and this file only) to reflect EST time.

Based upon the documentation The following algorithm is used.

  1. The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed.

  2. The administrator specifies the time_zone() parameter for the source driver that reads the message. This parameter overrides the original timezone of the message. Each source defaults to the value of the recv_time_zone() global option.

  3. The destination driver specifies the timezone via the time_zone() parameter. Each destination driver might have an associated timezone value to which message timestamps are converted before they are sent to the final destination (file or network socket). Each destination defaults to the value of the send_time_zone() global option. A message can be sent to multiple destination zones.

  4. When macro expansions are used in the destination filenames, the local timezone is used


So option #1 is not being done
I can't use #2 because my source is defined for all devices
I tried using #3.....  with the line modified as
destination d_pd_snort  { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) time_zone(-04:00) template(t_default)); };

However.. this does not seem to make any difference... Can you please tell me  why option #3 is not working ....
and also... why is it that in #1 it is not defauling to just adding the local timezone since the incoming message does not have a timezone specified.

Please help and thank you :)