In a file in /etc/rsyslog.d/ I have the following:

local3.*        /var/log/mylog.log

When I log to this facility, records have timestamps which look like this:

Apr 27 21:12:20 hostname msg

How do I set things up so that they look like this instead?

2014-04-27T21:12:20 hostname msg
  • What research have you done on your own? Rsyslog ships with this functionality, and a simple google search returned results with implementation instructions within the first few links. – EEAA Apr 27 '14 at 22:50
  • 1
    If you have an answer please share it. I did a google search which suggested that ISO8601 was the default timestamp format, but it is clearly not on Ubuntu 14.04. – jl6 Apr 28 '14 at 5:49
  • 3
    @EEAA, this question is now the top google search result for "rsyslog ubuntu iso8601 timestamps" and none of the other top 10 address this specific question which suggests to me that it was not a wholly terrible question to ask. – jl6 Apr 29 '14 at 19:48
  • This site is supposed to be the authoritative source for answers. Most of the content here can be found via Google search, but then the site would be lacking all of the content which drives page views. – Aaron Copley Apr 29 '14 at 20:03

This can be achieved by commenting out the following line in /etc/rsyslog.conf as the comment suggests:

# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

Log format now looks like this:

2014-04-29T20:41:36.366613+01:00 hostname msg
  • Don't forget to restart rsyslog after this (e.g. /etc/init.d/rsyslog restart) – davejagoda May 17 '17 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.