5

The format of the dates of my maillog logs looks like this:

May 12 04:12:54

I need to include the year on this date. Is it possible to make this kind of change?

3 Answers 3

3

After a little more research and some tests, I found the solution I need. My server works with CentOS 7.6, which use rsyslog to log.

  1. Edit the file /etc/rsyslog.conf and add the following template before the section "RULES":
$template MailLogFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
  1. Search for the line:
# Log all the mail messages in one place.
mail.*       -/var/log/maillog

and change to:

# Log all the mail messages in one place.
mail.*       -/var/log/maillog;MailLogFormat
  1. Restart rsyslog:
systemctl restart rsyslog

Done. The logs in the /var/log/maillog file will be printed with the date in the format: Year-Month-Day Hour:Minute:Second

1
  • On Ubuntu my Postfix log file is /var/log/mail.log but for the rest it all works. Dec 1, 2022 at 5:48
3

A possibly better answer is to employ the newer syslog standard to all rsyslog generated logs.....see

 http://support.pimpmylog.com/kb/softwares/rsyslog-protocol-23-format

The configuration is quite close to the RFC 5424 standard.

This is done by putting the following line in your rsyslog.conf file:

 $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

A given line in a syslog file would appear as follows:

 <27>1 2014-01-12T20:06:05.783312-05:00 somebody smbd 3752 - -  [2014/01/12 20:06:05.783190,  0] printing/print_cups.c:487(cups_async_callback)

Notice the full time and date are included as well as the TimeZone on the timestamp.

0

Thanks to dioo, the following worked for me in Ubuntu Server 20.04

  1. Goto rsyslog conf

    sudo nano /etc/rsyslog.conf

  2. Under Global Directives, comment out the existing style such as $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat and add the below line

$template CustomFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

  1. Save and close the file. Goto the default-conf file in the below location

    sudo nano /etc/rsyslog.d/50-default.conf

  2. Append "CustomFormat" after each log line you wish to change your timestamp

    user.* -/var/log/user.log;CustomFormat

  3. Restart the service

    sudo systemctl restart rsyslog

The final timestamp is as follows

2020-12-22 22:50:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .