As best as I can determine, there is a time zone problem associated with how the messages are generated through some of the channels. https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130 https://forum.openwrt.org/t/utc-timezones-used-for-apps-in-syslog-ng-instead... https://github.com/openwrt/packages/issues/18633 https://gitlab.nic.cz/turris/os/packages/-/issues/471 Changing how /dev/log is interpreted may either hide or resolve the issue, depending on your perspective: source s_devlog { unix-dgram("/dev/log", keep-timestamp(no)); }; Jeff On 8/14/22 8:56 PM, Francois Marier wrote:
I'm trying to understand timezones in syslog-ng, but I think there's something I'm missing.
If I do the following on my OpenWRT machine:
/etc/init.d/syslog-ng restart logger TestA
I see the following in /var/log/messages:
Aug 14 20:39:35 hostname syslog-ng[9860]: syslog-ng shutting down; version='3.37.1' Aug 14 20:39:36 hostname syslog-ng[10024]: syslog-ng starting up; version='3.37.1' Aug 14 20:39:36 hostname syslog-ng[10024]: Syslog connection established; fd='15', server='AF_INET(192.168.1.10:514)', local='AF_INET(0.0.0.0:0)' Aug 15 03:39:49 hostname root: TestA
The correct timezone is the one in the first three lines. Other daemon messages are displayed using the incorrect timezone like `logger`.
I've attached my syslog-ng.conf file.
So my question is why is the time information correct in the first three messages and then incorrect from there on?
Francois
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq