Syslog has 2 different timestamps

[IulianaNegura]

Hi all!

We have configured an applet to send a heartbeat message to out syslog server, but we have a problem with the timestamp.

Even though we have configured

service timestamps log datetime localtime msec show-timezone year

And we do have a correct output from show clock, there are 2 different timestamps  in the syslog messages

Mar 1 2024 17:02:35.689 CET: %SYS-5-CONFIG_I: Configured from console by admin on vty0
Mar 1 2024 17:04:51.732 CET: %SYS-5-CONFIG_I: Configured from console by admin on vty0
Mar 1 16:15:03.942: %syslog-6-LOG: Syslog_Heartbeat: Hearbeat message on syslog.info
Mar 1 2024 17:17:57.048 CET: %SYS-5-CONFIG_I: Configured from console by admin on vty0
Mar 1 2024 17:29:51.966 CET: %SYS-5-CONFIG_I: Configured from console by admin on vty0

You can notice there is a difference between %SYS-5-CONFIG_I and %syslog-6-LOG timestamps (and different formats) even though it is the same device.

Also, disabling service timestamps, it would not apply to %syslog-6-LOG messages

Is anyone having any idea why I am getting this? Is the applet (embeded service manager) getting the timestamp in a different manner? is this fixable?

Thank you!

[MHM Cisco World]

Check this command 

action 1.3 cli command "$_info_routername-config_$_event_pub_sec"

MHM

[IulianaNegura]

Hi, this does not work , I have tried this  and enabled debugging for the event manager

This is the output of debugging:

Mar  1 15:45:03.942: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : CTL : cli_open called.
Mar  1 15:45:03.944: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : OUT : switch1>
Mar  1 15:45:03.944: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : IN  : switch1>1709307903
Mar  1 15:45:04.058: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : OUT : 1709307903
Mar  1 15:45:04.058: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : OUT :   ^
Mar  1 15:45:04.058: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : OUT : % Invalid input detected at '^' marker.
Mar  1 15:45:04.059: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : OUT :
Mar  1 15:45:04.059: %HA_EM-6-LOG: Syslog_Heartbeat : DEBUG(cli_lib) : : OUT : switch1>
Mar 1 15:45:04.059: %syslog-6-LOG: Syslog_Heartbeat: Hearbeat message on syslog.info

[liviu.gheorghe · Accepted solution]

Hello @IulianaNegura ,

It seems that the %syslog-6-LOG is in a different timezone from the rest of the logging system, which makes me ask the question - do you have the clock timezone command configured on your device? For example:

clock timezone EET 2 0
clock summer-time EET recurring last Sat Mar 3:59 last Sat Oct 3:59

If clock timezone is not configured, can you configure it and see if the messages are still displayed the same as before?

If that doesn't solve the problem, do you have service timestamps debug configured on the device? It should be configured the same as service timestamps log: 

service timestamps debug datetime msec
service timestamps log datetime msec

Hope this helps.

[IulianaNegura]

Hi, thank you for your reply

I had these both settings configured

service timestamps log datetime localtime msec show-timezone year

clock timezone CET 1 0
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00

But the debug timestamps settings were not configured.

Thank you very much!

[liviu.gheorghe]

You are welcome. Glad to help.