[syslog-ng]timestamp issues

[David Douthitt]

Mickey Everts wrote:
> 
> How is it possible to have out of order time stamps?  My first thought would
> be that somehow the device itself is sending the timestamp.

That is the fact.  The syslog entry contains the time from the source
generating the syslog message.

> Aug  2 15:11:24 ap01.yipes.com KERN: NV:Completed configuration save
> (secondary) operation
> Aug  2 15:10:47 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_JUNOSCRIPT_ERROR:
> junoscript error: syntax error, expecting <command>
> Aug  2 15:11:26 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_CMDLINE_READ_LINE:
> user 'auser', command 'start shell '

In this case, the time on ap01.yipes.com is ahead of that on
t3-0-2-0.jp02.yipes.com.  The best way to fix this is to run NTP
(Network Time Protocol) on all of the servers; I recommend appointing
one machine to be ntp.yipes.com, synchronizing it to some Internet NTP
server, and let your entire company synchronize to ntp.yipes.com.