Adding year in the syslog message (linux)

Question

I need to log the year in the log message generated by syslog daemon. In particular in the /var/log/secure file. Is it possible?

Here an example of normal syslog message:

Feb 16 04:06:58 HOST sshd[28573]: Accepted password for USER from SOURCE port 7269 ssh2

And I need something similar to:

Feb 16 2011 04:06:58 HOST sshd[28573]: Accepted password for USER from SOURCE port 7269 ssh2

Thanks in advance.

Do you want to manipulate the existing log file or extract the data as such? — HyderA, Feb 21 '11 at 12:40
I don't want to manipulate the file. I want syslog to log the year with the rest of the date/time. — Possa, Feb 21 '11 at 12:50
The syslog "syslog", not syslog-ng or rsyslog. I can't install other daemons on those machine :( — Possa, Feb 21 '11 at 13:51
This is really idiotic! If you're processing logs, you have to do hacks based on the file timestamp, so that things don't break in the December -> January transition and other situations. — Kaz, Nov 30 '13 at 18:35

score 5 · Answer 1 · edited Nov 08 '12 at 10:37

5

If you use rsyslog, it is easy. Refer to following:

Modify /etc/rsyslog.conf to following:

...
authpriv.*     /var/log/secure;RSYSLOG_FileFormat
...

And then asking rsyslog daemon to reload configuration:
```
$ kill -HUP <pid of rsyslog daemon>
```

More reference :

edited Nov 08 '12 at 10:37

Kjuly

34,476
22
104
118

answered Oct 27 '11 at 17:20

Chance Hsu

73
2
7

This is too verbose; how to just change "Nov 30 HH:MM:SS" to "Nov 30 2013 HH:MM:SS". – Kaz Nov 30 '13 at 18:42

score 3 · Answer 2 · answered Dec 23 '11 at 21:01

3

syslog-ng has the ts_format() option to specify the default timestamp format for files. it is set to iso format by default, which includes the year.

you can also configure file formats using the template() option.

answered Dec 23 '11 at 21:01

bazsi77

521
2
6

score 2 · Answer 3 · answered Mar 02 '11 at 20:57

2

If your syslog respects RFC 3164 (The BSD Syslog Protocol), then you cannot configure it to record the year. Unless you have a modern syslog daemon that follows RFC 5424 (rsyslog or syslog-ng) you cannot do that.

answered Mar 02 '11 at 20:57

Dan Vatca

321
1
4

score 1 · Answer 4 · answered Dec 23 '11 at 21:08

1

If you can't alter the syslog on the system itself, maybe you could setup syslog to send it to a remote system with a better syslog daemon?

answered Dec 23 '11 at 21:08

Douglas Leeder

52,368
9
94
137

Adding year in the syslog message (linux)

4 Answers4