use_time_recvd(no) not working?
Hi! I've got a server (syslog-ng 1.5.14) with a innacurate system time (off by a minute) which logs to my master server (also syslog-ng 1.5.14). The option use_time_recvd(no) is in the masters config but the last changed time of the current logfile and the timestamps in the logfile are those of the senders server. Shouldn't the master syslog-ng strip all timestamp information from the logmessage and insert its own? I noticed this (obviously mis)behaviour because the PAM-stuff on the inaccurate server went mad and sends syslog entries with (nearly) correct time but the date is set to 2001-12-31; all other services log with correct timestamps. Here are some messages which cause the broken log-dates --- snip --- Mär 7 18:12:49 backup su: FAILED SU (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup su: (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup PAM-unix2[10112]: session started for user root, service su --- snap --- modify times of the two opened logfiles on the sending host (format is $HOST/$YEAR-$MONTH-$DAY): -rw------- 1 root root 3193 Mar 7 18:12 2001-12-31 -rw------- 1 root root 196130 Mar 7 19:17 2002-03-07 and here on the master server: -rw------- 1 root root 1814 Mar 7 18:13 2001-12-31 -rw------- 1 root root 39016 Mar 7 19:18 2002-03-07 a) do you have any tips on tracking down the problem with the broken pam-timestamps? b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? mfg -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support@inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699
a) do you have any tips on tracking down the problem with the broken pam-timestamps? b) is the use_time_recvd() option broken/non-existant in 1.5.14 ?
it exists, but only affects macro expansion. the timestamp in the message itself is never touched unless you use template output files like this: destination d_file { file("/var/log/messages" template("$DATE_RECVD $HOST $MSG\n")); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
At 09:36 08.03.2002 +0100, you wrote:
a) do you have any tips on tracking down the problem with the broken pam-timestamps? b) is the use_time_recvd() option broken/non-existant in 1.5.14 ?
it exists, but only affects macro expansion. the timestamp in the message itself is never touched unless you use template output files like this:
destination d_file { file("/var/log/messages" template("$DATE_RECVD $HOST $MSG\n")); };
$DATE_RECVD doesn't seem to be the correct variable to expand the local timestamp, when using it i get log entries like this: Mar 8 13:59:50_RECVD hp.priv.inode.at printer: peripheral low-power state Btw. are the timestamps of the syslog-messages when they get processed through syslogd/syslog-ng and sent over the network already in a human-readable format or something like the unix timestamp? If they're already in a human readable format maybe syslog-ng gets confused by the umlaut "ä" in the log message and can't translate "Mär" (März) to March, causing the wrong Date (31.12.2001) Example message: Mär 8 13:31:36 backup.priv.inode.at PAM-unix2[32226]: session finished for user root, service su best regards -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support@inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699
participants (2)
-
Balazs Scheidler
-
Michael Renner