# Syslog-NG - Timezone Issues

**URL:** <https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130>\
**Category:** Installing and Using OpenWrt\
**Created:** [November 10, 2019, 2:16am UTC](https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130 "2019-11-10T02:16:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lamelogin](https://forum.openwrt.org/user_avatar/forum.openwrt.org/lamelogin/32/99204_2.png) [@lamelogin](https://forum.openwrt.org/u/lamelogin)\
**Post date:** [November 10, 2019, 2:16am UTC](https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130/1 "2019-11-10T02:16:55Z")

</div>

Greetings,

I'm having issues with Syslog-NG displaying UTC time for events that are local to the device, but remote devices show local timezone. I can't figure out how to get syslog-ng to accept messages in localtime.

Google-foo tells me I need to use time\_zone("X"), but that's not working either. Any suggestions?

Image Version: OpenWrt 19.07-SNAPSHOT r10655-5fc63ec8a4 / LuCI openwrt-19.07 branch git-19.311.63582-dcc904d  
Syslog-NG: 3.24.1-1

```
# Install method
opkg install syslog-ng logrotate zoneinfo-northamerica zoneinfo-core

```

```
root@machinex:~# egrep -v ^# /etc/syslog-ng.conf

@version: 3.24
@include "scl.conf"
@include "/etc/syslog-ng.d/" # Put any customization files in this directory

options {
        chain_hostnames(no); # Enable or disable the chained hostname format.
        create_dirs(yes);
        keep_hostname(yes); # Enable or disable hostname rewriting.
        log_fifo_size(256); # The number of messages that the output queue can store.
        log_msg_size(1024); # Maximum length of a message in bytes.
        stats_freq(0); # The period between two STATS messages (sent by syslog-ng, containing statistics about dropped logs) in seconds.
        flush_lines(0); # How many lines are flushed to a destination at a time.
        use_fqdn(no); # Add Fully Qualified Domain Name instead of short hostname.
};

source src {
        internal();
        unix-dgram("/dev/log" time_zone("UTC"));
};

source net {
        udp(ip(0.0.0.0) port(514) time_zone("America/Chicago"));
};

source kernel {
        file("/proc/kmsg" program_override("kernel") time_zone("UTC"));
};

destination messages {
        file("/mnt/sda2/var/log/messages" time_zone("America/Chicago") );
};

log {
        source(src);
        source(net);
        source(kernel);
        destination(messages);
};

```

```
root@machinex:~# logger "local logger message 1"
root@machinex:~# logger "local logger message 2"
root@machinex:~# date; tail -f /var/log/messages
Sat Nov 9 20:15:16 CST 2019
Nov 9 20:14:53 machiney root: remote logger message 1
Nov 9 20:14:54 machiney root: remote logger message 2
Nov 10 02:15:03 machinex root: local logger message 1
Nov 10 02:15:05 machinex root: local logger message 2

```

---

<div class="post-metadata">

**Author:** ![anon50098793](https://forum.openwrt.org/letter_avatar/anon50098793/32/5_5575768a8748004e209b776fc1b2916d.png) [@anon50098793](https://forum.openwrt.org/u/anon50098793)\
**Post date:** [November 10, 2019, 4:07am UTC](https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130/2 "2019-11-10T04:07:33Z")

</div>

architect wise.. this would be better resolved on the sender...

but...

```
opkg list-installed | grep zone
find /usr/share/zoneinfo/

```

---

<div class="post-metadata">

**Author:** ![lamelogin](https://forum.openwrt.org/user_avatar/forum.openwrt.org/lamelogin/32/99204_2.png) [@lamelogin](https://forum.openwrt.org/u/lamelogin)\
**Post date:** [November 10, 2019, 1:25pm UTC](https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130/3 "2019-11-10T13:25:25Z")

</div>

wulfy23,

Thank you for your response. I've set the syslog server to "UTC" and everything is working as expected now except for dnsmaq logs. This is strange since all the devices in question are all set to "America/Chicago".

Doing a google search I find this: [https://forum.turris.cz/t/time-difference-is-system-log/1175/17](https://forum.turris.cz/t/time-difference-is-system-log/1175/17)

---

<div class="post-metadata">

**Author:** ![lamelogin](https://forum.openwrt.org/user_avatar/forum.openwrt.org/lamelogin/32/99204_2.png) [@lamelogin](https://forum.openwrt.org/u/lamelogin)\
**Post date:** [November 11, 2019, 7:54pm UTC](https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130/5 "2019-11-11T19:54:30Z")

</div>

I'm still seeing differences in timezones UTC vs Localtime using Syslog-NG. Let me try to see if RSyslogD will provide me different output?

---

<div class="post-metadata">

**Author:** ![lamelogin](https://forum.openwrt.org/user_avatar/forum.openwrt.org/lamelogin/32/99204_2.png) [@lamelogin](https://forum.openwrt.org/u/lamelogin)\
**Post date:** [November 11, 2019, 10:00pm UTC](https://forum.openwrt.org/t/syslog-ng-timezone-issues/48130/6 "2019-11-11T22:00:19Z")

</div>

RsyslogD seems to be working OK.. I'm going to use this.

Thank you for being the sounding board. 🙂