Syslog double timestamp - ASR9K

[TelesEC]

Hi all,

How can I do to suppress the double timestamp of the syslogs messages sent by my ASR9906 routers?

I tried to disable the command via 'no service timestamps log...' without success.

Mar 10 11:12:46 55930 <171> HOSTNAME RP/0/RSP1/CPU0:Mar 10 11:12:46.015 CET: smartlicserver[178]: %LICENSE-SMART_LIC-3-COMM_XXX...........

This double timestamp format gives problems to our monitoring team.

Thanks in advance.

[balaji.bandi]

is this syslog on device or syslog server ? can you post syslog config

[TelesEC]

Hi @balaji.bandi 

On the router I see only one timestamp ('show logg') but when the syslog messages reaches the server (tcpdump), I see two timestamps.

logging trap informational

logging events level informational

logging buffered xxxxxx

logging buffered informational

logging facility local7

logging A.B.C.D vrf mgmt severity info port default

logging hostnameprefix XYZ

Thanks

[balaji.bandi]

 but when the syslog messages reaches the server (tcpdump),

This system ammending that additional information, i have seen my syslog server does.

[TelesEC]

Thanks for your answer @balaji.bandi 

I did a test on a virtual mockup between two routers, one IOS-XRv and one IOS.

The IOS-XRv has the IOS IP address as a syslog server...when I did a traffic capture the syslog packet contained the two timestamps.... There was no real 'server' in between

[balaji.bandi]

So you logs sending to IOS router, that where you see this Logs with dual stamp ?

[Georg Pauwen]

Hello,

I recall having seen this before. The second 'timestamp' is not actually a timestamp, but part of the actual message. Hence there is no way to get rid of it.

[TelesEC]

Hi @Georg Pauwen 

Thanks for your comment, and the first timestamp where does it come from? Can it be removed?