cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
949
Views
15
Helpful
3
Replies

Syslog messages show three dates

jbendix
Level 1
Level 1

Jan 1 11:03:06 sw.local 482: Jan 1 11:02:53: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 172.16.10.2] [localport: 22] at 11:02:53 EST5EDT Fri Jan 1 2021

 

Switch: 3560x
IOS: 15.2

 

Why does syslog have three dates? The first date is the only one that I need/want.

 

Can I change this?

Catalyst 3000

 

I guest reason could be service timestamps but I am not completely sure

service timestamps log datetime localtime
aaa authentication login default local
login block-for 1800 attempts 3 within 60
login on-failure log
login on-success log
logging host 172.16.15.3

 

Yomeglel Coomeet Writer

1 Accepted Solution
3 Replies 3

Hello,

 

there was a user a short while ago with the same question. Here is the issue (and what it comes down to is that there is nothing you can do about it):

 

The normal timestamps have nothing to do with this syslog message. You can turn off all timestamping on the device, but the syslog would still give you the 'timestamp' at the end. This is because it is an integral part of the message body itself.

 

So, this 'timestamp' is not really a timestamp, and unfortunately, there is no way to truncate this specific message body to NOT display just the last characters (the 'timestamp').

Just out of curiosity, how did you solve this ? I tried I think about everything a while ago, but could not...