# ParseKernelTimestamp

Parses kernel-provided timestamps and uses them as the message time instead of the receive time.

This parameter applies to imklog: Kernel Log Input Module.

Name:

  ParseKernelTimestamp

Scope:

  module

Type:

  boolean

Default:

  off

Required?:

  no

Introduced:

  at least 5.x, possibly earlier

## Description

If enabled and the kernel creates a timestamp for its log messages, this timestamp will be parsed and converted into regular message time instead of using the receive time of the kernel message (as in 5.8.x and before). Default is ‘off’ to prevent parsing the kernel timestamp, because the clock used by the kernel to create the timestamps is not supposed to be as accurate as the monotonic clock required to convert it. Depending on the hardware and kernel, it can result in message time differences between kernel and system messages which occurred at the same time.

## Notes

- Legacy documentation referred to the type as “binary”; it behaves as a boolean value.

## Module usage

    module(load="imklog" parseKernelTimestamp="on")

### Legacy names (for reference)

Historic names/directives for compatibility. Do not use in new configs.

- $klogParseKernelTimestamp — maps to ParseKernelTimestamp (status: legacy)

## See also

imklog: Kernel Log Input Module

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.