There are actually two timestamps. "timereported" is taken from the message, but it requires that the sender included a timestamp (not all do). "timegenerated" is the time the message was received. The default templates use "timereported", as far as I remember. If it's important and you are in doubt, simply define your own template, so you know what you use ;)
Properties are described here: http://www.rsyslog.com/doc-property_replacer.html The rest is in the config guide (links at the bottom). Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of Santoshkumar K S > Sent: Monday, February 18, 2008 3:11 PM > To: [email protected] > Subject: [rsyslog] Doubt in syslog. > > > Hi, > > I have a doubt about a syslog file. > > In our system, all the client syslogs are forwarded to > single > syslog server. > > The timestamp found in syslog in syslog server is whether a > client timestamp or the server timestamp.....? > > Can u please answer this question...? > > > > Thanks, > > Santhosh Kumar.K.S. > > > > ======================================================================= > ===================================================== > > Disclaimer: > > This message and the information contained herein is proprietary and > confidential and subject to the Tech Mahindra policy statement, you may > review the policy at <a > href="http://www.techmahindra.com/Disclaimer.html";>http://www.techmahin > dra.com/Disclaimer.html</a> externally and <a > href="http://tim.techmahindra.com/Disclaimer.html";>http://tim.techmahin > dra.com/Disclaimer.html</a> internally within Tech Mahindra. > > ======================================================================= > ===================================================== > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
