Thanks for reply. Raw message (looked in tcpdump) contains timestamp without year. For example:
Jan 20 10:08:21 proxy mwg: status=....
I have commented line
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
in rsyslog.conf and I see that /var/log/messages contains full timestamp, but events are sent still in short format
... View more