1

I have a central logging server running rsyslog 7.x on RHEL 6

The logs are coming in with a UTC time but an EST offset for a device.

Here are some relevant configs.

$template TEMPLATE_NAME,"%TIMESTAMP:::date-rfc3339% %fromhost% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" [root@host ]# hwclock Thu 14 Feb 2019 05:35:25 PM EST -0.877530 seconds [root@host ]# date -u Thu Feb 14 22:35:28 UTC 2019 [root@host ]# date Thu Feb 14 17:35:29 EST 2019 [root@host ]# When I change the localtime to UTC and restart rsyslogd then the offset goes to +00:00 but when the localtime is in EST as it is now, only the offset changes to -05:00 but the time stamp would stay the same.

My goal is to have the logs reflect the local time with the proper offset.

So for a log written at 3PM EST my current outcome is 2019-02-14T20:49:31-05:00But i would expect 2019-02-14T15:49:31-05:00 Can someone please explain how to achieve this or why I am seeing what I am ?

0

So after some work, it turns out the device sending these logs wasn't sending them with any offset but was set to UTC. So the logs being ingested were just getting slapped with the system localtime offset and keeping their UTC time. The fix for me was to change the source to EST.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.