You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have a cisco switch running IOS 15.2. It is sending syslog to rsyslog with timestamps in the format: Jan 1 03:13:14.663 UTC:
rsyslog is configured to parse this with: parser(name="ciscoios" type="pmciscoios" present.origin="on") input(type="imudp" port="5514" ruleset="ciscoios") ruleset(name="ciscoios" parser="ciscoios") { call remote }
and forward it on to a central rsyslog server via RELP.
On the central server, the timestamp is stored as RFC3339 and is showing up as: 2019-01-01T03:13:14.663+00:00
It should be noted that the actual time of the event was 2020-01-01T03:13:14.663+00:00
and that both the local rsyslog server and the central rsyslog server have their system timezone set to EST (UTC-5)
I believe the issue comes up when converting from a timestamp that doesn't have a year to RFC3339 timestamps. There seems to be an assumption that the local system time year is to be used without adjusting for the timezone difference.
Both rsyslog servers are running rsyslogd 8.1911.0.
On the plus side, this will correct itself within 5 hours, and the logs aren't that hard to massage into their correct form, but I don't want to have to deal with this again next year.
The text was updated successfully, but these errors were encountered:
I have a cisco switch running IOS 15.2. It is sending syslog to rsyslog with timestamps in the format:
Jan 1 03:13:14.663 UTC:
rsyslog is configured to parse this with:
parser(name="ciscoios" type="pmciscoios" present.origin="on")
input(type="imudp" port="5514" ruleset="ciscoios")
ruleset(name="ciscoios" parser="ciscoios") { call remote }
and forward it on to a central rsyslog server via RELP.
On the central server, the timestamp is stored as RFC3339 and is showing up as:
2019-01-01T03:13:14.663+00:00
It should be noted that the actual time of the event was
2020-01-01T03:13:14.663+00:00
and that both the local rsyslog server and the central rsyslog server have their system timezone set to EST (UTC-5)
I believe the issue comes up when converting from a timestamp that doesn't have a year to RFC3339 timestamps. There seems to be an assumption that the local system time year is to be used without adjusting for the timezone difference.
Both rsyslog servers are running rsyslogd 8.1911.0.
On the plus side, this will correct itself within 5 hours, and the logs aren't that hard to massage into their correct form, but I don't want to have to deal with this again next year.
The text was updated successfully, but these errors were encountered: