Mailing List Archive

Syslog date/time occurs twice
Hey there,
I noticed that exim is adding date/time stamp before sending to syslog.

It is ok for mainlog as it seems put by exim directly :

/2018-07-16 02:10:19 dovecot_login authenticator failed for
(example.net) [164.39.218.210]: 535 Incorrect authentication data
(set_id=postmaster)/

But it syslog there's syslog time/date stamp + exim date/time stamp :

/Jul 16 02:10:19 hostname exim[5734]: 2018-07-16 02:10:19 dovecot_login
authenticator failed for (example.net) [164.39.218.210]: 535 Incorrect
authentication data (set_id=postmaster)/

It's causing trouble for my fail2ban regex. Is there a way to disable
this date/time stamp ?

Thanks in advance,
Regards,
--
<mailto:bc@chunkz.net>
Bertrand Caplet
IT Analyst
???? www.chunkz.net <https://www.chunkz.net>
Rennes (FR)
Feel free to send encrypted/signed messages
???? Key ID: 6E494EB9
???? More infos about GPG key here <https://keybase.io/bbcorp>
Re: Syslog date/time occurs twice [ In reply to ]
Hey,

Sorry for the up but it's still causing me trouble.
Does anyone know how to disable this double timestamp for exim log in
syslog ?

Thanks in advance,

Le 2018-07-16 19:35, Bertrand Caplet a écrit :

> Hey there,
> I noticed that exim is adding date/time stamp before sending to syslog.
>
> It is ok for mainlog as it seems put by exim directly :
>
> /2018-07-16 02:10:19 dovecot_login authenticator failed for
> (example.net) [164.39.218.210]: 535 Incorrect authentication data
> (set_id=postmaster)/
>
> But it syslog there's syslog time/date stamp + exim date/time stamp :
>
> /Jul 16 02:10:19 hostname exim[5734]: 2018-07-16 02:10:19 dovecot_login
> authenticator failed for (example.net) [164.39.218.210]: 535 Incorrect
> authentication data (set_id=postmaster)/
>
> It's causing trouble for my fail2ban regex. Is there a way to disable
> this date/time stamp ?
>
> Thanks in advance,
> Regards,

--

Bertrand Caplet

IT Analyst

???? www.chunkz.net [1]

Montpellier (FR)

Feel free to send encrypted/signed messages

???? Key ID: 6E494EB9

???? More infos about my GPG key here [2]



Links:
------
[1] https://www.chunkz.net
[2] https://keybase.io/bbcorp
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
Re: Syslog date/time occurs twice [ In reply to ]
On 05/02/2019 13:25, Bertrand Caplet via Exim-users wrote:
>> /Jul 16 02:10:19 hostname exim[5734]: 2018-07-16 02:10:19 dovecot_login
>> authenticator failed for (example.net) [164.39.218.210]: 535 Incorrect
>> authentication data (set_id=postmaster)/
>>
>> It's causing trouble for my fail2ban regex. Is there a way to disable
>> this date/time stamp ?


The syslog_timestamp option looks like it'd be one way.
--
Cheers,
Jeremy

--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/