From b80f10f39673239aa904a8db0f39e60727da5817 Mon Sep 17 00:00:00 2001
From: Daniel Micay <daniel.micay@grapheneos.org>
Date: Sat, 8 Nov 2025 14:43:41 -0500
Subject: [PATCH] syslog-ng: add receive timestamps to nginx logs

Since nginx only uses 1 second precision for the error logs and syslog
timestamps, we can use receive time on the syslog-ng side. We can switch
to source time once nginx adds RFC 5424 support which is currently in an
open pull request but will likely require changes to add a configuration
option for it. Our approach to working around this within nginx doesn't
work perfectly since $msec generates the time on-demand separately from
the timestamp used by $time_iso8601.
---
 etc/syslog-ng/conf.d/nginx.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/etc/syslog-ng/conf.d/nginx.conf b/etc/syslog-ng/conf.d/nginx.conf
index f848513..e6e2392 100644
--- a/etc/syslog-ng/conf.d/nginx.conf
+++ b/etc/syslog-ng/conf.d/nginx.conf
@@ -6,10 +6,10 @@ source s_nginx_error {
 };
 
 destination d_nginx_access {
-    file("/var/log/nginx/access.log" template("${MESSAGE}\n"));
+    file("/var/log/nginx/access.log" template("${R_ISODATE} ${MESSAGE}\n"));
 };
 destination d_nginx_error {
-    file("/var/log/nginx/error.log" template("${MESSAGE}\n"));
+    file("/var/log/nginx/error.log" template("${R_ISODATE} ${MESSAGE}\n"));
 };
 
 log {