On Sat, 11 May 2013, Konrad Vrba wrote:
thanks a lot David,
the RSYSLOG_FileFormat looks like this:
2013-05-11T09:49:32.702034+02:00
which is little bit more information that I am interested in. Is there no
predefined time in the "long-iso" format ?
2013-05-11 09:58:20
not that I know of. Long term, you really do want the timezone in there (unless
you have all your servers in GMT/UTC. I've been caught by this in the past.
Is the only way to define my own template, such as
$template long-iso,"%$NOW% %timereported:8:15%
%programname%.%syslogseverity-text%: %msg:R:[^ ][^ ]*.*$--end%\n"
The problem with my own template is that I have to use regular expressions
and complicated syntax to get something which I think should be standard.
rather than doing a regex, use the character position controls to trim what you
don't want.
But analysis software will deal with the ful long timestamp better than your
mid-length one.
David Lang
Cheers,
Konrad
On Sat, May 11, 2013 at 8:40 AM, David Lang <[email protected]> wrote:
On Sat, 11 May 2013, Konrad Vrba wrote:
Dear rsyslog comunity,
could somebody please advise what would be the best way to change the
default time format
May 11 09:20:04
to something more logical and "sortable", ie:
2013-05-11 09:20:04
I know I can create my own template, such as:
$template mytime,"%$NOW% %timereported:8:15%
%programname%.%syslogseverity-**text%: %msg:R:[^ ][^ ]*.*$--end%\n"
Byt I would prefer to change the default time format, so that I don't have
to specify mytime for every syslog rule. I would like to use mytime for
everything.
Try changing the default format (probably set by your distro) from
RSYSLOG_TradtionalFileFormat to RSYSLOG_FileFormat
you can also set the default format and then not need to specify it in
each action
$ActionFileDefaultTemplate myFormat
$ActionForwardDefaultTemplate myFormat
David Lang
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
