How to get rsyslog to honour msg hostname and timestamp for local connections

[peterand-pa]

Expected behavior

How to correctly parse incoming logs over loopback or unix socket so that the MSG hostname and timestamp is honoured

• and with the unix socket option not to interpret it as coming from journald

Actual behavior

Steps to reproduce the behavior

Any log message sent to unix socket or TCP connection to 127.0.0.1

Attempted config:

module(
   load="imuxsock"
)
input (
   Type="imuxsock"
   Socket="/var/run/syslog.sock"
   Unlink="on"
   Annotate="on"
   ParseTrusted="on"
   useSpecialParser="off"
   UseSysTimeStamp="off"
   parseHostname="on"
   RateLimit.Burst="100000"
   RateLimit.Interval="1"
)

Environment

rsyslogd 8.24.0-57.el7_9.3, compiled with:
PLATFORM: x86_64-redhat-linux-gnu

[davidelang]

I don't understand the problem, if you send something over 127.0.0.1, rsyslog will honor the hostname and timestamp in the log for uxsocket, I think it's configurable. please log the message with the template RSYSLOG_DebugFormat so we can see exactly what you are sending, and then show us what you are getting that you think is incorrect. for imuxdocket, you have it explicitly configured not to look for a timestamp. But again, show us a sample log that's not being parsed the way you think it should be and we can then reason what's going wrong. David Lang

…

On Thu, 22 Feb 2024, peterand-pa wrote: ### Expected behavior How to correctly parse incoming logs over loopback or unix socket so that the MSG hostname and timestamp is honoured - and with the unix socket option not to interpret it as coming from journald ### Actual behavior ### Steps to reproduce the behavior Any log message sent to unix socket or TCP connection to 127.0.0.1 Attempted config: ``` module( load="imuxsock" ) input ( Type="imuxsock" Socket="/var/run/syslog.sock" Unlink="on" Annotate="on" ParseTrusted="on" useSpecialParser="off" UseSysTimeStamp="off" parseHostname="on" RateLimit.Burst="100000" RateLimit.Interval="1" ) ``` ### Environment rsyslogd 8.24.0-57.el7_9.3, compiled with: PLATFORM: x86_64-redhat-linux-gnu