[syslog-ng] Multiple timezone seen on messages originating from local machine

[Jeff Kletsky]

As best as I can determine, there is a time zone problem associated with 
how the messages are generated through some of the channels.


https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130

https://forum.openwrt.org/t/utc-timezones-used-for-apps-in-syslog-ng-instead-of-configured-one/45095 


https://github.com/openwrt/packages/issues/18633

https://gitlab.nic.cz/turris/os/packages/-/issues/471


Changing how /dev/log is interpreted may either hide or resolve the 
issue, depending on your perspective:

source s_devlog {
         unix-dgram("/dev/log", keep-timestamp(no));
};


Jeff

On 8/14/22 8:56 PM, Francois Marier wrote:
> I'm trying to understand timezones in syslog-ng, but I think there's
> something I'm missing.
>
> If I do the following on my OpenWRT machine:
>
>    /etc/init.d/syslog-ng restart
>    logger TestA
>
> I see the following in /var/log/messages:
>
>    Aug 14 20:39:35 hostname syslog-ng[9860]: syslog-ng shutting down; version='3.37.1'
>    Aug 14 20:39:36 hostname syslog-ng[10024]: syslog-ng starting up; version='3.37.1'
>    Aug 14 20:39:36 hostname syslog-ng[10024]: Syslog connection established; fd='15', server='AF_INET(192.168.1.10:514)', local='AF_INET(0.0.0.0:0)'
>    Aug 15 03:39:49 hostname root: TestA
>
> The correct timezone is the one in the first three lines. Other daemon
> messages are displayed using the incorrect timezone like `logger`.
>
> I've attached my syslog-ng.conf file.
>
> So my question is why is the time information correct in the first three
> messages and then incorrect from there on?
>
> Francois
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>