6

In a file in /etc/rsyslog.d/ I have the following:

local3.*        /var/log/mylog.log

When I log to this facility, records have timestamps which look like this:

Apr 27 21:12:20 hostname msg

How do I set things up so that they look like this instead?

2014-04-27T21:12:20 hostname msg
jl6
  • 2,455
  • 2
  • 18
  • 19
  • 1
    What research have you done on your own? Rsyslog ships with this functionality, and a simple google search returned results with implementation instructions within the first few links. – EEAA Apr 27 '14 at 22:50
  • 1
    If you have an answer please share it. I did a google search which suggested that ISO8601 was the default timestamp format, but it is clearly not on Ubuntu 14.04. – jl6 Apr 28 '14 at 05:49
  • 4
    @EEAA, this question is now the top google search result for "rsyslog ubuntu iso8601 timestamps" and none of the other top 10 address this specific question which suggests to me that it was not a wholly terrible question to ask. – jl6 Apr 29 '14 at 19:48
  • This site is supposed to be the authoritative source for answers. *Most* of the content here can be found via Google search, but then the site would be lacking all of the content which drives page views. – Aaron Copley Apr 29 '14 at 20:03

1 Answers1

10

This can be achieved by commenting out the following line in /etc/rsyslog.conf as the comment suggests:

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

Log format now looks like this:

2014-04-29T20:41:36.366613+01:00 hostname msg
jl6
  • 2,455
  • 2
  • 18
  • 19
  • 1
    Don't forget to restart rsyslog after this (e.g. ```/etc/init.d/rsyslog restart```) – davejagoda May 17 '17 at 04:47
  • On later Ubuntu versions with systemd (introduced in 13.04, default in 15.04+), you can run `systemctl restart rsyslog` as root or using sudo. `systemctl status rsyslog` will show you status info, including how long it's been running. – Luke Griffiths Jun 22 '21 at 05:09