search for: rsyslog_traditionalfileformat

...le + +#### MODULES #### +\$ModLoad imuxsock.so # provides support for local system logging (e.g. via logger command) +\$ModLoad imklog.so # provides kernel logging support (previously done by rklogd) + +#### GLOBAL DIRECTIVES #### +# Use default timestamp format +\$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat + +#### RULES #### +# Log anything (except mail) of level info or higher. +# Don't log private authentication messages! +*.info;mail.none;authpriv.none;cron.none /var/log/messages + +# The authpriv file has restricted access. +authpriv.*...

One of my servers is using ISO datetime formats (2011-02-27T15:22:15.519857-05:00) in the logs the rest use the default redhat/CentOS format (Feb 27 15:10:21). After a couple of hours searching google I cannot find where this is defined. I know I changed it some months ago as an experiment but forgotten where this was done. the ISO format breaks logwatch - thus I need to revert. TIA

...essage capability # Provides RELP syslog reception $ModLoad imrelp $InputRELPServerRun 2514 # provides RELP syslog transmission $ModLoad omrelp #### GLOBAL DIRECTIVES #### # Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # File to store the position in the journal $IMJournalS...

...#$ModLoad immark.so # provides --MARK-- message capability # Provides UDP syslog reception #$ModLoad imudp.so #$UDPServerRun 514 # Provides TCP syslog reception #$ModLoad imtcp.so #$InputTCPServerRun 514 #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # (BUG!) # FQDN must be the first directive or it is not honored # http://bugzilla.adiscon.com/show_bug.cgi?id=192 #$PreserveFQDN on ... omitted... </config> [0] http://bugzilla.adiscon.com/show_bug.cgi?id=192 [1] http://serverfault.com/questions/274625/how-do-i-get-rsyslogd-to-log-a-serve...

...Load imklog # reads kernel messages (the same are read from journald) # Provides RELP syslog reception $ModLoad imrelp $InputRELPServerRun 2514 #### GLOBAL DIRECTIVES #### # Where to place auxiliary files $WorkDirectory /var/lib/rsyslog # Use default timestamp format #$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # File syncing capability is disabled by default. This feature is usually not required, # not useful and an extreme performance hit #$ActionFileEnableSync on # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # File to store the position in the journal $IMJournalS...

I having a problem where Logwatch is not showing any events from the /var/log/secure log file. When I run logwatch --print --range today --service sshd --detail 10 --debug 10 the end result shows this: ... LogFiles that will be processed: [0] = secure [1] = messages Made Temp Dir: /var/cache/logwatch/logwatch.sOga48bL with tempdir export LOGWATCH_DATE_RANGE='today' export

...d) +$ModLoad imklog.so # provides kernel logging support (previously done by rklogd) + +# Provides TCP syslog reception +$ModLoad imgssapi.so +$InputGSSServerServiceName rsyslog +$InputGSSServerRun 514 + +#### GLOBAL DIRECTIVES #### + +# Use default timestamp format +$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat + +#### RULES #### + +# The following templates inspired by Chef http://wiki.opscode.com/display/chef/Home + +$template PerHostAuth,"/var/log/remote/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/auth.log" +$template PerHostCron,"/var/log/remote/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/cron.log"...