[syslog-ng] Multiple timezone seen on messages originating from local machine

[Balazs Scheidler]

On /dev/log (the usual means of submitting messages) the timestamp is
formatted by the syslog() function call, part of libc (probably musl in the
case of openwrt).

Libc uses /etc/localtime to query the local time zone.

On Mon, Aug 15, 2022, 05:56 Francois Marier <francois at fmarier.org> wrote:

> I'm trying to understand timezones in syslog-ng, but I think there's
> something I'm missing.
>
> If I do the following on my OpenWRT machine:
>
>   /etc/init.d/syslog-ng restart
>   logger TestA
>
> I see the following in /var/log/messages:
>
>   Aug 14 20:39:35 hostname syslog-ng[9860]: syslog-ng shutting down;
> version='3.37.1'
>   Aug 14 20:39:36 hostname syslog-ng[10024]: syslog-ng starting up;
> version='3.37.1'
>   Aug 14 20:39:36 hostname syslog-ng[10024]: Syslog connection
> established; fd='15', server='AF_INET(192.168.1.10:514)', local='AF_INET(
> 0.0.0.0:0)'
>   Aug 15 03:39:49 hostname root: TestA
>
> The correct timezone is the one in the first three lines. Other daemon
> messages are displayed using the incorrect timezone like `logger`.
>
> I've attached my syslog-ng.conf file.
>
> So my question is why is the time information correct in the first three
> messages and then incorrect from there on?
>
> Francois
>
> --
> https://fmarier.org/
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20220815/c13b0c0b/attachment.htm>