Hi, have you checked that it's not your logserver ho adds a timestamp itself? I'm not sure, but afair rsyslog adds own timestamps and you have to use a template to get rid of them.
Regards, Axel Am Donnerstag, 19. Februar 2015, 04:49:28 schrieb scaarup: > Hi all. > I am logging to syslog with the following configuration: > log_format custom '$remote_addr $remote_user ' > '"$request" $status $body_bytes_sent ' > '"$http_referer" "$http_user_agent" UPSTREAM: > $upstream_addr SSL: $ssl_protocol $ssl_cipher $ssl_session_reused TIME: > $request_time'; > access_log syslog:server=localhost,facility=local2 custom; > error_log syslog:server=localhost,facility=local1 info; > Access.log entries looks like this: > Feb 19 10:39:50 localhost nginx: 192.168.11.18 - "GET /%%% HTTP/1.1" 400 166 > "-" "-" UPSTREAM: - SSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 r TIME: 0.008 > And error.log entries looks like this: > Feb 19 10:39:19 localhost nginx: 2015/02/19 10:39:19 [info] 53270#0: *1032 > client sent invalid request while reading client request line, client: > 192.168.11.18, server: payment.architrade.com, request: "GET /%%% HTTP/1.1" > > As you can see, the error log has two timestamps. How do I get rid of the > one? My rsyslog-conf is handling local1 and local2 the same way, so I am > thinking, since error_log directive has no log_format, nginx sends over a > timestamp by default. > > Posted at Nginx Forum: > http://forum.nginx.org/read.php?2,256786,256786#msg-256786 > > _______________________________________________ > nginx mailing list > [email protected] > http://mailman.nginx.org/mailman/listinfo/nginx _______________________________________________ nginx mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx
