Good morning,

My syslog server has stopped working right, although it is working. I never thought about backing up that configuration (darn!) I mean how hard can Syslog be right?

I have two problems I am trying to resolve.

1) The time from external machines (specifically a Cisco PIX firewall) are logging UTC time, but not local time. I remember there was an entry that needed to be added - I think to the rsyslog.conf file. But I can't find a reference to that anywhere. As an example the old log file showed:

Apr 24 08:44:15 Apr 24 2012 14:37:15: %PIX-5-304001: Accessed URL

And the new one (after upgrade) shows:

Apr 25 12:58:52 %PIX-5-304001: Accessed URL

I can't remember how I had gotten it to show both local and UTC time. Local machine events are logging the correct time.

2) I previously had the firewall entries logging to a separate file. Now they're all dumping into both the "syslog" and "messages" files. The section from my rsyslog.conf file:

# Cisco Configuration Section
local7.debug /var/log/cisco

3) Just curious - why do some paths in this config file start off with a "-"? For example:

news.notice -/var/log/news/news.notice

Thanks - appreciate any assistance you can provide!