I'm trying to get rsyslog on RHEL 6 to render the time the message was logged at as a unix timestamp. I started by read the documentation at http://www.rsyslog.com/doc/property_replacer.html. Since there are are old-style and new-style property options, I next checked my version number:
[root@sourwood remote]# rpm -qa | grep rsyslog rsyslog-pgsql-5.8.10-6.el6.x86_64 rsyslog-5.8.10-6.el6.x86_64 [root@sourwood remote]#
This implies to me that I am using version 5.8. The docs say to use the new-style property options in versions greater than 6, therefore, I should use the old-style property options.
The top of the section describing the old-style options states that the options listed below exist in versions greater than 5.5.3, since 5.8.10 is greater than 5.5.3 that shouldn't be a problem.
Based on the docs I have created the following template (truncated a little for clarity):
I then use this template in the following way:
if \ $programname contains 'squid' \ then /var/log/remote/squid.log;proxyTemplate
The messages from Squid do get logged, and the rfc3339 formatting is working, but the unix timestamp is not. Here is a truncated sample from the logs:
Apr 29 14:59:09|2013-04-29T14:59:09.443172+01:00|...
Am I doing something wrong? Perhaps I've missed some subtlty? Or have I hit upon a bug?
To be sure to be sure I've also tried with the new-style property options, but to no avail.