I don't get the point...what's wrong with the log?

(r)syslog uses the 3rd field to identify host. That works fine with logs from cisco, linux, bsd, and solaris boxes. For those that do not, you can edit the log file format. I have not tried OSX but I think it should be editable too.

But, in this switch the 3rd field seems to be for another time stamp; what is it used for anyway?

Well, I am afraid there is no way for us to do such kind of configurations.

I have not tried OSX but I think it should be editable too. Fifa 15 Coins

Hi raubvogel,

you can switch the LogFormat in your syslogserver for this devices. I configured two templates and linked it two special logging sources:

Here my configuration:
[CODE]cat /etc/rsyslog.d/host-templates.conf
# Log remote hosts to separate log file
$template PerHostLog,"/var/log/remote-hosts/%HOSTNAME%.log"
$template RemoteHostFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
### Begin TP-LINK configuration ###
$template TPLinkHostLog,"/var/log/remote-hosts/%FROMHOST%.log"
$template TPLinkHostFileFormat,"%TIMESTAMP% %FROMHOST% %syslogfacility-text% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::space-cc,drop-last-lf%\n"
:FROMHOST, contains, "tplinkswitch1" ?TPLinkHostLog;TPLinkHostFileFormat
& ~
:FROMHOST, contains, "tplinkswitch2" ?TPLinkHostLog;TPLinkHostFileFormat
& ~
### End TP-LINK configuration ###
:inputname, isequal, "imudp" ?PerHostLog;RemoteHostFileFormat
& ~
:inputname, isequal, "imtcp" ?PerHostLog;RemoteHostFileFormat
& ~[/CODE]

Perhaps can use it.