Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Timezone differences cause incorrect Year to be logged. #4079

Open
parinioa opened this issue Jan 1, 2020 · 1 comment
Open

Timezone differences cause incorrect Year to be logged. #4079

parinioa opened this issue Jan 1, 2020 · 1 comment

Comments

@parinioa
Copy link

parinioa commented Jan 1, 2020

I have a cisco switch running IOS 15.2. It is sending syslog to rsyslog with timestamps in the format:
Jan 1 03:13:14.663 UTC:

rsyslog is configured to parse this with:
parser(name="ciscoios" type="pmciscoios" present.origin="on")
input(type="imudp" port="5514" ruleset="ciscoios")
ruleset(name="ciscoios" parser="ciscoios") { call remote }

and forward it on to a central rsyslog server via RELP.

On the central server, the timestamp is stored as RFC3339 and is showing up as:
2019-01-01T03:13:14.663+00:00

It should be noted that the actual time of the event was
2020-01-01T03:13:14.663+00:00
and that both the local rsyslog server and the central rsyslog server have their system timezone set to EST (UTC-5)

I believe the issue comes up when converting from a timestamp that doesn't have a year to RFC3339 timestamps. There seems to be an assumption that the local system time year is to be used without adjusting for the timezone difference.

Both rsyslog servers are running rsyslogd 8.1911.0.

On the plus side, this will correct itself within 5 hours, and the logs aren't that hard to massage into their correct form, but I don't want to have to deal with this again next year.

@parinioa
Copy link
Author

As a workaround, it turns out IOS supports logging the year as well with the command
service timestamps log datetime msec localtime show-timezone year

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant