[solved] Rsyslogd always using UTC

I can't figure out how to change the timezone that rsyslogd uses.

My system uses CET. date output is something like:

Wed Mar 17 14:14:06 CET 2021

But rsyslogd seems to ignore the timezone and just uses utc in the messages. Like:

Mar 17 13:14:47 router : [origin software="rsyslogd" swVersion="8.39.0" x-pid="8377" x-info="http://www.rsyslog.com"] start

Any ideas how to change this?

What is the output of uci export system ?

1 Like
~# uci export system
package system

config system
        option hostname 'router'
        option timezone 'CET-1CEST,M3.5.0,M10.5.0/3'
        option ttylogin '0'
        option log_size '64'
        option urandom_seed '0'
        option cronloglevel '8'

uci set system.zonename='Europe/Prague' ; uci commit system ; service system restart

1 Like

Are you sure it's rsyslogd which is using UTC, and not the device sending the syslog data which is using UTC?

1 Like

I added to /etc/config/system

option zonename 'Europe/Brussels'

but that didn't change the rsyslog timestamp.

The logs with the wrong timezone aren't from a remote host, but locally created.

But looking some more into my system, I noticed I don't have /tmp/TZ. Linking that to /tmp/localtime and restarting rsyslog solved the problem.

Is that a bug I should report? If so, what would be the bug? That /tmp/TZ is not created at boot or that rsyslog reads /tmp/TZ instead of /tmp/localtime?

1 Like

Try to comment the default timestamp template and add custom template with timegenerated option in the rsyslog config file.

# Use default timestamp format
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#Custom Time format
$template myFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\n"
$ActionFileDefaultTemplate myFormat

Reload the rsyslog service.

opkg update; opkg install zoneinfo-europe

1 Like

The zoneinfo packages were already installed.

As I wrote before, linking /tmp/TZ to /tmp/localtime solved the problem. It seems to me, rsyslog checks /tmp/TZ to determine if any timezone is set. And if that file is missing, then it uses UTC.

rm /etc/TZ; ln -s /tmp/localtime /etc/TZ

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.