The format of the dates of my maillog logs looks like this:

May 12 04:12:54

I need to include the year on this date. Is it possible to make this kind of change?

3 Answers 3


After a little more research and some tests, I found the solution I need. My server works with CentOS 7.6, which use rsyslog to log.

  1. Edit the file /etc/rsyslog.conf and add the following template before the section "RULES":
$template MailLogFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
  1. Search for the line:
# Log all the mail messages in one place.
mail.*       -/var/log/maillog

and change to:

# Log all the mail messages in one place.
mail.*       -/var/log/maillog;MailLogFormat
  1. Restart rsyslog:
systemctl restart rsyslog

Done. The logs in the /var/log/maillog file will be printed with the date in the format: Year-Month-Day Hour:Minute:Second

  • On Ubuntu my Postfix log file is /var/log/mail.log but for the rest it all works. Dec 1, 2022 at 5:48

A possibly better answer is to employ the newer syslog standard to all rsyslog generated logs.....see


The configuration is quite close to the RFC 5424 standard.

This is done by putting the following line in your rsyslog.conf file:

 $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

A given line in a syslog file would appear as follows:

 <27>1 2014-01-12T20:06:05.783312-05:00 somebody smbd 3752 - -  [2014/01/12 20:06:05.783190,  0] printing/print_cups.c:487(cups_async_callback)

Notice the full time and date are included as well as the TimeZone on the timestamp.


Thanks to dioo, the following worked for me in Ubuntu Server 20.04

  1. Goto rsyslog conf

    sudo nano /etc/rsyslog.conf

  2. Under Global Directives, comment out the existing style such as $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat and add the below line

$template CustomFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

  1. Save and close the file. Goto the default-conf file in the below location

    sudo nano /etc/rsyslog.d/50-default.conf

  2. Append "CustomFormat" after each log line you wish to change your timestamp

    user.* -/var/log/user.log;CustomFormat

  3. Restart the service

    sudo systemctl restart rsyslog

The final timestamp is as follows

2020-12-22 22:50:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .