Rsyslog – Change Timestamp Format for Specific Filter

1. ISO 8601 format should be adhered to as much as possible, since it is the closest thing there is to a standard.
2. The 'T' is not enough of a stumbling block to really warrant getting rid of it.
3. The ':'s are potentially killers, so those should be avoided.
4. For the reasons mentioned in others' answers, UTC (or 'Z' time) should be used.
5. ISO 8601 includes a format using UTC ('Z' time), which should be used.
6. ISO 8601 includes a format that does not use the ':' character, which should be used.

So...sample 'best' date-time formats:

1. 20120317T1748Z

   • 100% in accordance with ISO 8601
   • alphanumeric characters only (very sysadmin-friendly)
   • not the quickest to read, but certainly readable by the layperson

2. 2012-03-17T1748Z

   • date portion is in accordance with ISO 8601
   • time portion is in accordance with ISO 8601
   • transition between date and time is in accordance with ISO 8601
   • mixes the ISO 8601 'extended' format (date with hyphens, time with colons) with the ISO 8601 'basic' format (date without hyphens, time without colons), which is likely not quite right
   • adds '-' character (vs 1.)
   • a bit easier for the layperson to read (vs 1.)

3. 2012-03-17--1748Z

   • date portion is in accordance with ISO 8601
   • time portion is in accordance with ISO 8601
   • transition between date and time is not in accordance with ISO 8601
   • mixes the ISO 8601 'extended' format with the ISO 8601 'basic' format
   • a bit easier for the layperson to read (vs 1. and 2.)
   • no new characters (vs 2.)

I am partial to 1. since it is fully IAW the standard, but the others are close.

Note:: Add seconds as necessary, of course. ...and yes, with or without seconds (or even minutes) is all IAW ISO 8601. :)

The problem was actually coming from logrotate.

Basically with my configuration, running unicorn, I don't need to use the copytruncate directive. (which is what causes problems here)

USR1 - Reopen all logs owned by the worker process. See Unicorn::Util.reopen_logs for what is considered a log. Log files are not reopened until it is done processing the current request, so multiple log lines for one request (as done by Rails) will not be split across multiple logs.

This started working properly after updating to this configuration:

/home/user/my_app/shared/log/*.log {
  daily
  missingok
  dateext
  rotate 30
  compress
  notifempty
  extension gz
  create 640 user user
  sharedscripts

  post-rotate
    # Telling Unicorn to reload files
    test -s /home/user/my_app/shared/pids/unicorn.pid && kill -USR1 "$(cat /home/user/my_app/shared/pids/unicorn.pid)"

    # Reloading rsyslog telling it that files have been rotated
    reload rsyslog 2>&1 || true
  endscript
}