Changing date format in syslog

user_1277939 0
Viewed 30811

Is there anyway we can change the date format in a particular log file being logged to by syslog? I don't want to change the way all logs are being logged, but just by log file.

EDIT: I'm using syslogd (in FreeBSD)

This is how my file looks like now:

Dec  5 07:52:10 Log data 1
Dec  5 07:52:10 Log data 2
Dec  5 07:52:10 Log data 3

This is how I want it to look like:

20131205 07:52:10 Log data 1
20131205 07:52:10 Log data 2
20131205 07:52:10 Log data 3

My syslog.conf looks like this, where /var/log/my_log.log is my logfile:

+@
*.notice;local0.none;local1.none;local2.none;authpriv.none;kern.debug;mail.crit;news.err        /var/log/messages
security.*                                      /var/log/security
auth.info;authpriv.info                         /var/log/auth.log
mail.info                                       /var/log/maillog
ftp.info                                        /var/log/xferlog
cron.*                                          /var/log/cron
*.=debug                                        /var/log/debug.log
console.info                                    /var/log/console.log

local1.info                                     /var/log/my_log.log
syslog freebsd date linux
5 Answers

There are always a new options for the date problem, adding just a couple of lines.
My solution comes adding a file to /etc/rsyslog.d/, for example myrsyslog.conf, then add the format of your choice, mine is:

$template myformat,"%TIMESTAMP:1:10:date-rfc3339% %TIMESTAMP:19:12:date-rfc3339% %syslogtag%%msg%\n"
$ActionFileDefaultTemplate myformat

this will apply the new format to your logs making it easy to parse.

before

Sep  3 12:52:37 whs dhcpcd[477]: wlan0: expired address ...
Sep  3 12:52:37 whs dhcpcd[477]: wlan0: part of Router Advertisement expired
Sep  3 12:52:37 whs dhcpcd[477]: wlan0: deleting route to ...

after

2020-09-03 13:00:49 systemd[1]: rsyslog.service: Succeeded. 
2020-09-03 13:00:49 systemd[1]: Stopped System Logging Service. 
2020-09-03 13:00:49 systemd[1]: Starting System Logging Service...
user_44495160

Many years later rsyslog has replaced syslogd and this has gotten super easy:

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
#$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

Comment out that one line and done.

user_1475620
Related