When the syslog daemon writes to the syslog file, what is the time stamp it writes? is it the host date/time or the event date/time?
We quite often use the following in the syslog config -
template("${DATE} ${MSGHDR}${MSG}\n");
Hi
I suppose that you are using syslog-ng? If so you can see those macro definitions from here https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.18/administration-.... That said that those hard coded (like DATE) macros are from message.
r. Ismo