[solved] Rsyslogd always using UTC

[MagicSimi]

I can't figure out how to change the timezone that rsyslogd uses.

My system uses CET. date output is something like:

Wed Mar 17 14:14:06 CET 2021

But rsyslogd seems to ignore the timezone and just uses utc in the messages. Like:

Mar 17 13:14:47 router : [origin software="rsyslogd" swVersion="8.39.0" x-pid="8377" x-info="http://www.rsyslog.com"] start

Any ideas how to change this?

[trendy]

What is the output of uci export system ?

[MagicSimi]

~# uci export system
package system

config system
        option hostname 'router'
        option timezone 'CET-1CEST,M3.5.0,M10.5.0/3'
        option ttylogin '0'
        option log_size '64'
        option urandom_seed '0'
        option cronloglevel '8'
[...]

[trendy]

uci set system.zonename='Europe/Prague' ; uci commit system ; service system restart

[iplaywithtoys]

@MagicSimi

Mar 17 13:14:47 router

Are you sure it's rsyslogd which is using UTC, and not the device sending the syslog data which is using UTC?

[MagicSimi]

I added to /etc/config/system

option zonename 'Europe/Brussels'

but that didn't change the rsyslog timestamp.

The logs with the wrong timezone aren't from a remote host, but locally created.

But looking some more into my system, I noticed I don't have /tmp/TZ. Linking that to /tmp/localtime and restarting rsyslog solved the problem.

Is that a bug I should report? If so, what would be the bug? That /tmp/TZ is not created at boot or that rsyslog reads /tmp/TZ instead of /tmp/localtime?

[pavelgl]

Try to comment the default timestamp template and add custom template with timegenerated option in the rsyslog config file.

# Use default timestamp format
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#Custom Time format
$template myFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
$ActionFileDefaultTemplate myFormat

Reload the rsyslog service.

[trendy]

opkg update; opkg install zoneinfo-europe

[MagicSimi]

The zoneinfo packages were already installed.

As I wrote before, linking /tmp/TZ to /tmp/localtime solved the problem. It seems to me, rsyslog checks /tmp/TZ to determine if any timezone is set. And if that file is missing, then it uses UTC.

[trendy]

rm /etc/TZ; ln -s /tmp/localtime /etc/TZ