Rsyslog on Ubuntu 14.04 – Configure to Use ISO8601 Timestamps

rsyslogsyslogUbuntu

In a file in /etc/rsyslog.d/ I have the following:

local3.*        /var/log/mylog.log

When I log to this facility, records have timestamps which look like this:

Apr 27 21:12:20 hostname msg

How do I set things up so that they look like this instead?

2014-04-27T21:12:20 hostname msg

Best Answer

This can be achieved by commenting out the following line in /etc/rsyslog.conf as the comment suggests:

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

Log format now looks like this:

2014-04-29T20:41:36.366613+01:00 hostname msg

Related Solutions

Ubuntu – How to log iptables in Ubuntu just in /var/log/firewall with rsyslogd

Use a discard action after the iptables log, but before the other logs.

kern.warning   /var/log/firewall.log
kern.warning   ~
*.*            /var/log/messages

Ubuntu – How to get rsyslogd to log a server’s FQDN instead of it’s short hostname

I ran into this issue as well. Here is how I was able to fix it.

On the clients modify the /etc/hosts file so the desired hostname comes before localhost.

127.0.0.1 hostnameforlogs localhost
On the clients and server modify /etc/rsyslog.conf to include this statement:

$PreserveFQDN on
On the server I used the %HOSTNAME% variable for the templates in rsyslog.conf:

Best Answer

Related Solutions

Ubuntu – How to log iptables in Ubuntu just in /var/log/firewall with rsyslogd

Ubuntu – How to get rsyslogd to log a server’s FQDN instead of it’s short hostname

Related Topic