The format of the dates of my maillog logs looks like this:

May 12 04:12:54

I need to include the year on this date. Is it possible to make this kind of change?


A possibly better answer is to employ the newer syslog standard to all rsyslog generated logs.....see


The configuration is quite close to the RFC 5424 standard.

This is done by putting the following line in your rsyslog.conf file:

 $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

A given line in a syslog file would appear as follows:

 <27>1 2014-01-12T20:06:05.783312-05:00 somebody smbd 3752 - -  [2014/01/12 20:06:05.783190,  0] printing/print_cups.c:487(cups_async_callback)

Notice the full time and date are included as well as the TimeZone on the timestamp.


After a little more research and some tests, I found the solution I need. My server works with CentOS 7.6, which use rsyslog to log.

  1. Edit the file /etc/rsyslog.conf and add the following template before the section "RULES":
$template MailLogFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
  1. Search for the line:
# Log all the mail messages in one place.
mail.*       -/var/log/maillog

and change to:

# Log all the mail messages in one place.
mail.*       -/var/log/maillog;MailLogFormat
  1. Restart rsyslog:
systemctl restart rsyslog

Done. The logs in the /var/log/maillog file will be printed with the date in the format: Year-Month-Day Hour:Minute:Second

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.