BIG-IP syslog - send logs with UTC timezone, while APM is in different timezone

Forums Technical Forums
1

Hi,

I’m lookign for a way to send out logs to remote syslog server with UTC timestamp.

APM is using corporate NTP server that are in GMT +1 time zone and that’s how the logs are being send.

I tried to edit /sys syslog all-properties and add something like below to have date in ISO format + timezone amended. However as ISODATE is working, time_zone variable is not ( I tried it with “UTC”, "GMT, “-01:00”, etc)

Any other options I could use ?

options { proto-template(t_isostamp); };
template t_isostamp { template(\"$ISODATE $HOST $MSGHDR$MSG\\n\"); };

destination d_remote_loghost {
        tcp(\"x.x.x.x\" port(514) template(t_isostamp) time_zone(UTC));
    };
"

2

Hello  @qba ,

Have you tried this?

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.24/administration-guide/template-and-rewrite-format-modify-and-manipulate-log-messages/modifying-messages-using-rewrite-rules/rewrite-the-timezone-of-a-message/

3

Note: both udp() and tcp() are deprecated in the included version of syslog-ng. Here’s my discussion:

https://community.f5.com/discussions/technicalforum/big-ip-syslog-include/334242