Syslog-NG - Timezone Issues

Greetings,

I'm having issues with Syslog-NG displaying UTC time for events that are local to the device, but remote devices show local timezone. I can't figure out how to get syslog-ng to accept messages in localtime.

Google-foo tells me I need to use time_zone("X"), but that's not working either. Any suggestions?

Image Version: OpenWrt 19.07-SNAPSHOT r10655-5fc63ec8a4 / LuCI openwrt-19.07 branch git-19.311.63582-dcc904d
Syslog-NG: 3.24.1-1

# Install method
opkg install syslog-ng logrotate zoneinfo-northamerica zoneinfo-core
root@machinex:~# egrep -v ^# /etc/syslog-ng.conf

@version: 3.24
@include "scl.conf"
@include "/etc/syslog-ng.d/" # Put any customization files in this directory

options {
        chain_hostnames(no); # Enable or disable the chained hostname format.
        create_dirs(yes);
        keep_hostname(yes); # Enable or disable hostname rewriting.
        log_fifo_size(256); # The number of messages that the output queue can store.
        log_msg_size(1024); # Maximum length of a message in bytes.
        stats_freq(0); # The period between two STATS messages (sent by syslog-ng, containing statistics about dropped logs) in seconds.
        flush_lines(0); # How many lines are flushed to a destination at a time.
        use_fqdn(no); # Add Fully Qualified Domain Name instead of short hostname.
};

source src {
        internal();
        unix-dgram("/dev/log" time_zone("UTC"));
};

source net {
        udp(ip(0.0.0.0) port(514) time_zone("America/Chicago"));
};

source kernel {
        file("/proc/kmsg" program_override("kernel") time_zone("UTC"));
};

destination messages {
        file("/mnt/sda2/var/log/messages" time_zone("America/Chicago") );
};

log {
        source(src);
        source(net);
        source(kernel);
        destination(messages);
};

root@machinex:~# logger "local logger message 1"
root@machinex:~# logger "local logger message 2"
root@machinex:~# date; tail -f /var/log/messages
Sat Nov  9 20:15:16 CST 2019
Nov  9 20:14:53 machiney root: remote logger message 1
Nov  9 20:14:54 machiney root: remote logger message 2
Nov 10 02:15:03 machinex root: local logger message 1
Nov 10 02:15:05 machinex root: local logger message 2

architect wise.. this would be better resolved on the sender...

but...

opkg list-installed | grep zone
find /usr/share/zoneinfo/

wulfy23,

Thank you for your response. I've set the syslog server to "UTC" and everything is working as expected now except for dnsmaq logs. This is strange since all the devices in question are all set to "America/Chicago".

Doing a google search I find this: https://forum.turris.cz/t/time-difference-is-system-log/1175/17

1 Like

I'm still seeing differences in timezones UTC vs Localtime using Syslog-NG. Let me try to see if RSyslogD will provide me different output?

RsyslogD seems to be working OK.. I'm going to use this.

Thank you for being the sounding board. :slightly_smiling_face:

1 Like