The default configuration of rsyslogd writes log entries in the traditional format, which looks like this:
Nov 30 10:40:01 localhost CRON: pam_unix(cron:session): session closed for user list
There is no year, which is inconvenient for tools that process logs and that require an exact time stamp for each entry, have to implement hacks which guess the year.
We can switch rsyslogd to a built-in template called
RSYSLOG_FileFormat which changes to a high-precision timestamp. While this is RFC timestamp format is fine for processing, it is verbose gibberish with no whitespace that is hard on the human eyes.
2013-11-30T10:50:01.478204-08:00 localhost CRON: ...
Unfortunately, the template system of rsyslogd is very unfriendly and the documentation is poor. Incredibly, for all the unnecessary complexity in this template system, the value of
dateformat is evidently linked to a hard coded C
enum of choices!
There are parameters like
$YEAR but these just pull out the current time, not the one from the message timestamp, so that is a hack.
I just want to concentrate on writing the program program which processes the entries.
What is the right blurb I can put into a
rsyslogd.conf file to get this exact output:
Nov 30 2013 10:40:01 localhost CRON: ...
Just the traditional template, plus year.