How to include millisecond in syslogs?
16,015
Solution 1
By default, rsyslog
uses traditional timestamp, which in date
command's format would be:
%b %d %H:%M:%S
This is enabled by the following line in /etc/rsyslog.conf
:
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
To enable high precision timestamping, comment out the line:
# $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
which will make rsyslog
timestamping in the RFC 3339 format.
The RFC 3339 format can be simulated by the date
command:
% date '+%Y-%m-%dT%H:%M:%S.%6N%:z'
2016-06-05T18:27:58.721607+06:00
Or even shorter:
% date '+%FT%T.%6N%:z'
2016-06-05T18:29:32.569776+06:00
Or using the native --rfc-3399
option:
% date --rfc-3339=ns
2016-06-05 18:31:50.897557592+06:00
Solution 2
In /etc/rsyslog.conf
, replace
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
with:
$template CustomFormat,"%timegenerated:1:10:date-rfc3339% %timegenerated:12:24:date-rfc3339% %syslogtag%%msg%\n"
$ActionFileDefaultTemplate CustomFormat
Now, if you logger test && tail -1 /var/log/syslog
, you'd get:
2020-08-10 18:28:49.5397 user: test
Related videos on Youtube
Author by
RaulGupta
Updated on September 18, 2022Comments
-
RaulGupta over 1 year
I have configured
rsyslog.conf
file in/etc
to include my own logs assyslogs
in a file at/var/logs
.But after opening the file I got this:
Jun 5 10:09:09 lab-Altos-G330-Mk2 slog[19689]: Hello1 Jun 5 10:09:09 lab-Altos-G330-Mk2 slog[19689]: Hello2
Here, the
timestamp
only has second resolution. I want to know how to configurersyslog
to display milliseconds also? -
RaulGupta almost 8 yearsThanks for the solution.,but now I am getting microseconds..,can I configure rfc 3339 to give me milliseconds..?
-
heemayl almost 8 years@user3767070 Ummm, i don't see anything native in
rsyslog
..You need to parse the logs manually i am afraid.. -
Strachu over 2 yearsThe syntax is documented at rsyslog.com/doc/v8-stable/configuration/property_replacer.html