01-26-2021 03:46 AM
Jan 1 11:03:06 sw.local 482: Jan 1 11:02:53: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: admin] [Source: 172.16.10.2] [localport: 22] at 11:02:53 EST5EDT Fri Jan 1 2021
Switch: 3560x
IOS: 15.2
Why does syslog have three dates? The first date is the only one that I need/want.
Can I change this?
Catalyst 3000
I guest reason could be service timestamps but I am not completely sure
service timestamps log datetime localtime
aaa authentication login default local
login block-for 1800 attempts 3 within 60
login on-failure log
login on-success log
logging host 172.16.15.3
Solved! Go to Solution.
01-26-2021 04:13 AM
check this tread may help you :
https://community.cisco.com/t5/switching/syslog-messages-show-three-dates/m-p/4265778
01-26-2021 04:13 AM
check this tread may help you :
https://community.cisco.com/t5/switching/syslog-messages-show-three-dates/m-p/4265778
01-26-2021 05:03 AM
Hello,
there was a user a short while ago with the same question. Here is the issue (and what it comes down to is that there is nothing you can do about it):
The normal timestamps have nothing to do with this syslog message. You can turn off all timestamping on the device, but the syslog would still give you the 'timestamp' at the end. This is because it is an integral part of the message body itself.
So, this 'timestamp' is not really a timestamp, and unfortunately, there is no way to truncate this specific message body to NOT display just the last characters (the 'timestamp').
01-28-2021 04:09 AM
Just out of curiosity, how did you solve this ? I tried I think about everything a while ago, but could not...
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide