Hi,

have you checked that it's not your logserver ho adds a timestamp itself?
I'm not sure, but afair rsyslog adds own timestamps and you have to use a
template to get rid of them.

Regards, Axel

Am Donnerstag, 19. Februar 2015, 04:49:28 schrieb scaarup:
> Hi all.
> I am logging to syslog with the following configuration:
> log_format custom '$remote_addr $remote_user '
> '"$request" $status $body_bytes_sent '
> '"$http_referer" "$http_user_agent" UPSTREAM:
> $upstream_addr SSL: $ssl_protocol $ssl_cipher $ssl_session_reused TIME:
> $request_time';
> access_log syslog:server=localhost,facility=local2 custom;
> error_log syslog:server=localhost,facility=local1 info;
> Access.log entries looks like this:
> Feb 19 10:39:50 localhost nginx: 192.168.11.18 - "GET /%%% HTTP/1.1" 400
166
> "-" "-" UPSTREAM: - SSL: TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 r TIME:
0.008
> And error.log entries looks like this:
> Feb 19 10:39:19 localhost nginx: 2015/02/19 10:39:19 [info] 53270#0: *1032
> client sent invalid request while reading client request line, client:
> 192.168.11.18, server: payment.architrade.com, request: "GET /%%%
HTTP/1.1"
>
> As you can see, the error log has two timestamps. How do I get rid of the
> one? My rsyslog-conf is handling local1 and local2 the same way, so I am
> thinking, since error_log directive has no log_format, nginx sends over a
> timestamp by default.
>
> Posted at Nginx Forum:
> http://forum.nginx.org/read.php?2,256786,256786#msg-256786
>
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx