Hi Michael,
Thanks for the quick answers!
On Wed, Feb 21, 2024 at 01:30:50PM +0100, Michael Biebl wrote:
> The Debian package does not ship any patches in that regard.
> It's thus best if you raise this issue directly upstream at
>
https://github.com/rsyslog/rsyslog/issues
I've made an upstream bug-report on the issue at
https://github.com/rsyslog/rsyslog/issues/5332
On Wed, Feb 21, 2024 at 01:40:21PM +0100, Michael Biebl wrote:
> Am 21.02.24 um 12:09 schrieb Ralf Schlatterbeck:
> > Unfortunately this causes logcheck to completely ignore all the remote logs
> > because it matches on a 32-byte timestamp (and the timestamp of the remote
> > machine only has 25 byte).
>
> This is a bug in the logcheck rules, I'd say. It should deal with timestamps
> having no subseconds resolution.
>
>
https://www.rsyslog.com/doc/configuration/properties.html
> I suppose that for remote messages it uses "timereported", which typically
> uses a resolution in seconds
I still think that rsyslog should not mix two different timestamp
formats in the same logfile with the same template configuration. And
yes, maybe logcheck should recognize both formats with/without
subseconds part.
Thanks
Ralf
--
Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16
Open Source Consulting www:
www.runtux.com
Reichergasse 131, A-3411 Weidling email:
off...@runtux.com