The default configuration of rsyslogd writes log entries in the traditional format, which looks like this:Nov 30 10:40:01 localhost CRON[30786]: pam_unix(cron:session): session closed for user listThere is no year, which is inconvenient for tools that process logs and that require an exact time stamp for each entry, have to implement hacks which guess the year.We can switch rsyslogd to a built-in template called RSYSLOG_FileFormat which changes to a high-precision timestamp. While this is RFC timestamp format is fine for processing, it is verbose gibberish with no whitespace that is hard on the human eyes.2013-11-30T10:50:01.478204-08:00 localhost CRON[31200]: ...Unfortunately, the template system of rsyslogd is very unfriendly and the documentation is poor. Incredibly, for all the unnecessary complexity in this template system, the value of dateformat is evidently linked to a hard coded C enum of choices!There are parameters like $YEAR but these just pull out the current time, not the one from the message timestamp, so that is a hack.I just want to concentrate on writing the program program which processes the entries. What is the right blurb I can put into a rsyslogd.conf file to get this exact output:Nov 30 2013 10:40:01 localhost CRON[31200]: ...Just the traditional template, plus year.
Add year to entries generated by rsyslogd
rsyslog
Well, I pulled out rsyslog from its git, made a branch from the closest line to what my system is running and patched it:2013-11-30 13:39:59 localhost sshd[17331]: Accepted publickey for kaz from 192.1...The above is now produced thanks to these rsyslog.conf lines:$template CustomFormat,%timegenerated:::date-strftime(%Y-%m-%d %H:%M:%S)% %HOSTNAME% %syslogtag%%msg%0\n$ActionFileDefaultTemplate CustomFormatThe format given in the question is just %b %d %Y %H:%M:%S.The new thing is date-strftime(...) which specifies a date property that is based on strftime formatting. This is applied to the time in the log message (either received time or generated time).Having come into contact with this codebase, I'm now going to shower and soak in bathtub. Feb 2016 update:Looks like this topic came up in a rsyslogd mailing list in 2014, with a reference to this Unix Stackexchange question (the original poster complains that date-strftime isn't working in the version of rsyslogd he's using. No kidding!)This resulted in issue 65 which completely ignores the existence of my strftime-based patch  and goes with a clumsy approach with custom replacement items for day of week, hour, year and so on. For instance, to get the year, you have to use %timestamp:::date-year%.  This %timestamp:::xxx verbosity has to be repeated for every element of the date!Thus %timestamp:::date-strftime(%Y-%m-%d %H:%M:%S) turns into:%timestamp:::date-year%-%timestamp:::date-month%-%timestamp:::date-day% %timestamp:::date-hour%:%timestamp:::date-minute%:%timestamp:::date-second%Good grief!