-----Original Message-----
From: Hall J D (ISeLS) [mailto:jdhall@glam.ac.uk]
Sent: Wednesday, June 30, 2004 10:53 AM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng]use_time_recvd() not working?

Hello all,

I've recently installed Syslog-ng 1.6.2 on a FreeBSD 4.9 to act as my new collector and I can't get the use_time_recvd() option to work properly.

No matter if I specify  use_time_recvd(yes) or  use_time_recvd(no) the messages, from a Cisco PIX firewall, are still getting recorded with the time from the message and not the local time.

Is this a know issue, or am I doing something really silly?

Below are the relevant bits from my config

Thanks,

Jonathan

options { long_hostnames(off); sync(0); use_time_recvd(yes);
                create_dirs(yes); dir_perm(0750); };

source net {    udp(ip(193.63.147.98) port(514));
                tcp(ip(193.63.147.98) port(1740) keep-alive(yes)); };

destination fwall { file("/var/log/firewalls/$HOST.$YEAR.$MONTH.$DAY.log"
                        perm(0640)); };

filter f_pixmsg { match("%PIX"); };

filter f_local0 { facility(local0); };

log { source(net); filter(f_local0); filter(f_pixmsg); destination(fwall); };

Use of email is inherently insecure. Confidential information, including account information, and personally identifiable information, should not be transmitted via email, or email attachment. In no event shall Citizens or any of its affiliates accept any responsibility for the loss, use or misuse of any information including confidential information, which is sent to Citizens or its affiliates via email, or email attachment. Citizens does not guarantee the accuracy of any email or email attachment, that an email will be received by Citizens or that Citizens will respond to any email.

This email message is confidential and/or privileged. It is to be used by the intended recipient only. Use of the information contained in this email by anyone other than the intended recipient is strictly prohibited. If you have received this message in error, please notify the sender immediately and promptly destroy any record of this email.