1

I have a router that forwards its logs to an rsyslog server and I'd like to configure the rsyslog server to replace the timestamp with a local timestamp. The message format looks like this:

Jan  1 00:00:47 192.168.1.254 kernel: br0: port 1(eth0) entered forwarding state

What's the best way to do this for all messages from this router (192.168.1.254)?

1

1 Answer 1

2

The easiest way to handle this is to write a template that is a copy of the template you are already using, and change the timestamp property to the timegenerated property. Eg, assuming you are writing to a file and using the default RSYSLOG_TraditionalFileFormat template, then you can create myFileFormat, test for the ip address and put in your matching rules. In legacy format the rule uses the log filename followed by ; and the name of the template:

template(name="myFileFormat" type="string" string="%timegenerated% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp% %msg:::drop-last-lf%\n") 
if $fromhost-ip == "192.168.1.254" then {
   *.* /my/logfile;myFileFormat
   stop
}
1
  • This is perfect thanks. It's also clicked for me now how templates work.
    – goji
    Commented May 27, 2020 at 9:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .