Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a file in /etc/rsyslog.d/ I have the following:

local3.*        /var/log/mylog.log

When I log to this facility, records have timestamps which look like this:

Apr 27 21:12:20 hostname msg

How do I set things up so that they look like this instead?

2014-04-27T21:12:20 hostname msg
share|improve this question
What research have you done on your own? Rsyslog ships with this functionality, and a simple google search returned results with implementation instructions within the first few links. – EEAA Apr 27 '14 at 22:50
If you have an answer please share it. I did a google search which suggested that ISO8601 was the default timestamp format, but it is clearly not on Ubuntu 14.04. – jl6 Apr 28 '14 at 5:49
@EEAA, this question is now the top google search result for "rsyslog ubuntu iso8601 timestamps" and none of the other top 10 address this specific question which suggests to me that it was not a wholly terrible question to ask. – jl6 Apr 29 '14 at 19:48
This site is supposed to be the authoritative source for answers. Most of the content here can be found via Google search, but then the site would be lacking all of the content which drives page views. – Aaron Copley Apr 29 '14 at 20:03
up vote 3 down vote accepted

This can be achieved by commenting out the following line in /etc/rsyslog.conf as the comment suggests:

# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

Log format now looks like this:

2014-04-29T20:41:36.366613+01:00 hostname msg
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.