How to change the date format of maillog?

Question

The format of the dates of my maillog logs looks like this:

May 12 04:12:54

I need to include the year on this date. Is it possible to make this kind of change?

Answer 1

After a little more research and some tests, I found the solution I need. My server works with CentOS 7.6, which use rsyslog to log.

1. Edit the file /etc/rsyslog.conf and add the following template before the section "RULES":

$template MailLogFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

2. Search for the line:

# Log all the mail messages in one place.
mail.*       -/var/log/maillog

and change to:

# Log all the mail messages in one place.
mail.*       -/var/log/maillog;MailLogFormat

3. Restart rsyslog:

systemctl restart rsyslog

Done. The logs in the /var/log/maillog file will be printed with the date in the format: Year-Month-Day Hour:Minute:Second

Answer 2

A possibly better answer is to employ the newer syslog standard to all rsyslog generated logs.....see

 http://support.pimpmylog.com/kb/softwares/rsyslog-protocol-23-format

The configuration is quite close to the RFC 5424 standard.

This is done by putting the following line in your rsyslog.conf file:

 $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

A given line in a syslog file would appear as follows:

 <27>1 2014-01-12T20:06:05.783312-05:00 somebody smbd 3752 - -  [2014/01/12 20:06:05.783190,  0] printing/print_cups.c:487(cups_async_callback)

Notice the full time and date are included as well as the TimeZone on the timestamp.

Answer 3

Thanks to dioo, the following worked for me in Ubuntu Server 20.04

1. Goto rsyslog conf

   sudo nano /etc/rsyslog.conf

2. Under Global Directives, comment out the existing style such as $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat and add the below line

$template CustomFormat, "%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

3. Save and close the file. Goto the default-conf file in the below location

   sudo nano /etc/rsyslog.d/50-default.conf

4. Append "CustomFormat" after each log line you wish to change your timestamp

   user.* -/var/log/user.log;CustomFormat

5. Restart the service

   sudo systemctl restart rsyslog

The final timestamp is as follows

2020-12-22 22:50:19