major difference in log source time to start time

I want to make sure I understand this situation before I go to our system engineers. From one particular site, I have some logs that have a couple of months difference between log source time and start time. The log is coming across as:

Jun 01 11:23:14 AgentDevice=WindowsLog AgentLogFile=Security Source=Microsoft-Windows-Security-Auditing ….. EventID=4776 EventIDCode=4776 EventType=16 EventCategory=14336 RecordNumber=312593 TimeGenerated=1473965593963 TimeWritten=1473965593963

So the syslog timestamp is showing Jun 01, but the Epoch time log is showing Thursday, September 15, 2016 6:53:13.963 PM GMT. So if I understand this correctly, the syslog timestamp is stamped by the system that is forwarding the log to the event collector. The event collector takes the log and doesn’t modify the raw, but puts the log in the system with a start time and a storage time, but those times are not stamped on the actual log itself. So the three times we see in the raw log (syslog timestamp, timegenerated, and timewritten) are completely generated and stamped by the system that the event happened on. Correct?

Just asking this as a side question in case anyone has seen this before, do you know why this might be happening? Is it because the system was shutdown before being able to sync the logs or is the system not able to see that it sent these logs before so it is trying to catch up and it is sending old logs?


Can the SaaS DataPower agent syslog be sent to an alternate path?

Question on APM Data Power agent and the ability to change the Syslog daemon configuration to write
syslogs at alternative path

We are installing the Datapower agent and other agents (IIB,MQ) on an IIB Server.

While configuring the IBM Datapower agent, the Datapower syslog is merged with IIB syslog.

Our Admins want to separate the Datapower Agent syslog from IIB syslogs.

We need help to configure Datapower agent and syslog daemon to receive the
data power syslogs at alternative path location for Datapower agent.

This link refers to 1) Red Hat and 2) Suse Linux

I but could not find any information on AIX.

In the section **Enabling syslog** it states:
If you want the DataPower® agent to monitor the system logs of the DataPower Appliance, in addition to setting up the syslog on the appliance, you must also enable syslog on the computer that hosts the
DataPower agent.

**Before you begin**

If the DataPower agent is installed on a Windows operating system, you must first install a system log daemon on the computer to collect the system logs. Alternatively, you can save the system log files on a
shared disk and ensure that the agent has the authority to read the system log files on that disk.

To enable syslog, depending on the operating system that hosts the DataPower agent, complete one of the following procedures:

**On Red Hat Enterprise Linux 6, to open the syslog.conf file, run the vi /etc/syslog.conf command.**

a. Append the Syslog_fac.* /var/log/filename command to the end of the syslog.conf file and save it. Syslog_fac is the syslog facility and file name is the name of the file where you save the syslog.

b. To open the syslog.conf file, run the vi /etc/syslog.conf command.

c. Change the value of the SYSLOGD_OPTIONS parameter to the following value: SYSLOGD_OPTIONS = “-m 0 -r”

Note: Depending on the Linux distribution, this variable might also be named SYSLOGD_PARAMS.

d. To restart the syslog server, run the service syslog restart command.

**On SUSE Linux Enterprise Server 11, to enable syslog-ng, complete the following steps:**

a. To open the syslog file, run the vi /etc/sysconfig/syslog command.

b. Verify that the value of the SYSLOG_DAEMON parameter is syslog-ng.

c. In the syslog-ng.conf file, append the following line to the definition of the src source:
tcp(ip(“ip_address”) port(port_number) keep-alive(yes));

Where ip_address is the IP address of the computer that hosts the DataPower agent and port_number is the port number that is used for receiving syslog-ng messages.

d. To filter messages from the DataPower appliances, in the syslog-ng.conf file, create a filter. For example,
the filter f_dp {level(debug..emerg) and facility(user);};

filter statement defines a filter that accepts messages from the debug level to the emergency level that specify the user as the syslog facility.

e. In the syslog-ng.conf file, use a destination statement to define where the messages are written as shown in the following example:

destination dplog {file(“/var/log/dpsyslog.log”);};

This destination statement specifies that messages are written to the
dpsyslog.log file in the /var/log directory.

f. In the syslog-ng.conf file, use a log statement to connect sources and destinations. For example,
the log {source(src);filter(f_dp);destination(dplog);};

log statement connects the src source and the dplog destination.

g. Save the syslog-ng.conf file.

h. To restart the syslog server, run the /etc/init.d/syslog restart command.

In the Configure Log Target pane it shows Syslog-ng (deprecated)

Please confirm that Syslog-ng will work on AIX.


Event ID 27 — Channel Initialization

Event ID 27 — Channel Initialization

Updated: August 5, 2011

Applies To: Windows Server 2008 R2

Event logs are normally initialized when the Event Log service starts. This initialization can also happen during installation of a component that creates a new log. When the initialization fails, the log is not available to receive events and the diagnostic and troubleshooting capabilities of administrators, support personnel, developers, and automated utilities can be compromised.

The application-defined logs are specific to the event provider that created them and will only affect events published by that provider. The operations that remain for the Event Log service and all other event providers are not affected when there is a problem with one of the event logs being initialized.

Event Details

Product: Windows Operating System
ID: 27
Source: Microsoft-Windows-Eventlog
Version: 6.1
Message: The event logging service encountered an error (res=%1) while opening log file for channel %2. Trying again using default log file path %3.

Reconfigure the location to the log file

To change the path to a log file, open Event Viewer, right-click on the log to update, and select Properties. Change the value of the Log path field and click Apply.


Use the Event Viewer to read the affected log on the local computer after the computer has been restarted, and verify that events 20, 23, 25, 26, or 40 did not appear in the event log after the system was restarted.

Related Management Information

Channel Initialization

Management Infrastructure