5

The default configuration of rsyslogd writes log entries in the traditional format, which looks like this:

Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user list

There is no year, which is inconvenient for tools that process logs and that require an exact time stamp for each entry, have to implement hacks which guess the year.

We can switch rsyslogd to a built-in template called RSYSLOG_FileFormat which changes to a high-precision timestamp. While this is RFC timestamp format is fine for processing, it is verbose gibberish with no whitespace that is hard on the human eyes.

2013-11-30T10:50:01.478204-08:00 localhost CRON[31200]: ...

Unfortunately, the template system of rsyslogd is very unfriendly and the documentation is poor. Incredibly, for all the unnecessary complexity in this template system, the value of dateformat is evidently linked to a hard coded C enum of choices!

There are parameters like $YEAR but these just pull out the current time, not the one from the message timestamp, so that is a hack.

I just want to concentrate on writing the program program which processes the entries.

What is the right blurb I can put into a rsyslogd.conf file to get this exact output:

Nov 30 2013 10:40:01 localhost CRON[31200]: ...

Just the traditional template, plus year.

8

Well, I pulled out rsyslog from its git, made a branch from the closest line to what my system is running and patched it:

2013-11-30 13:39:59 localhost sshd[17331]: Accepted publickey for kaz from 192.1...

The above is now produced thanks to these rsyslog.conf lines:

$template CustomFormat,"%timegenerated:::date-strftime(%Y-%m-%d %H:%M:%S)% %HOSTNAME% %syslogtag%%msg%0\n"
$ActionFileDefaultTemplate CustomFormat

The format given in the question is just %b %d %Y %H:%M:%S.

The new thing is date-strftime(...) which specifies a date property that is based on strftime formatting.

This is applied to the time in the log message (either received time or generated time).

Having come into contact with this codebase, I'm now going to shower and soak in bathtub.

Feb 2016 update:

Looks like this topic came up in a rsyslogd mailing list in 2014, with a reference to this Unix Stackexchange question (the original poster complains that date-strftime isn't working in the version of rsyslogd he's using. No kidding!)

This resulted in issue 65 which completely ignores the existence of my strftime-based patch and goes with a clumsy approach with custom replacement items for day of week, hour, year and so on. For instance, to get the year, you have to use %timestamp:::date-year%. This %timestamp:::xxx verbosity has to be repeated for every element of the date!

Thus %timestamp:::date-strftime(%Y-%m-%d %H:%M:%S) turns into:

%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second%

Good grief!

  • 2
    me loving the bathtub sentence – Tshepang Jun 29 '15 at 11:24
  • 3
    To clarify for anyone else who wants to use it, the complete text that you need to paste into your rsyslog.conf file is two lines. First line: $template CustomFormat,"%timegenerated:::date-year%-%timegenerated:::date-month%-%timegenerated:::date-day% %timegenerated:::date-hour%:%timegenerated:::date-minute%:%timegenerated:::date-second% %HOSTNAME% %syslogtag%%msg%\n" Second line: $ActionFileDefaultTemplate CustomFormat – gogoud Nov 7 '16 at 16:33
2

A little late answer, but you can cut the year from rfc3339 date format and plug it in between the two parts of rfc3164 date format like so:

$template myTemplate,"%timegenerated:1:6:date-rfc3164% %timegenerated:1:4:date-rfc3339% %timegenerated:8:15:date-rfc3164% %HOSTNAME% %syslogtag%%msg%\n"

*.* /var/log/my.log;myTemplate

Tested on rsyslogd 7.4.4

0

In the file /etc/rsyslog.conf, comment the line $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat. Commenting this will generate timestamps with RFC 3339 format, which is a high-precision timestamp.

  • The question already notes this solution and rejects it. See the text: "While this is RFC timestamp format is fine for processing, it is verbose gibberish with no whitespace that is hard on the human eyes." What the question wants is the traditional format, augmented with a year. – Kaz Jul 7 '15 at 13:55
-1

I had the same requirement, and what I did is:

$template MyCustomFmt,"%$YEAR% %timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate MyCustomFmt

Note the $YEAR prefix.

  • You missed this key text in the question: "There are parameters like $YEAR but these just pull out the current time, not the one from the message timestamp, so that is a hack." – Kaz Jul 7 '15 at 13:52
  • Ah! OK, accept, missed that part! – vyom Jul 8 '15 at 6:16
  • @Kaz, so there is no other way, than to patch the code - like you did? – vyom Jul 8 '15 at 6:17
  • Looking at the code itself, I could not see how it could produce the desired behavior. – Kaz Jul 8 '15 at 12:14
-1

This fixed my problem:

$template MyCustomFmt,"%$YEAR% %timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate MyCustomFmt

Thanks @vyom for solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.