SYSLOG Format

[Jason Shannon]

Hello

Does anyone know if a mechanism exists which would allow me to change the format of the information being written to syslog?

I'm really interested in the actual date format to see if I can include a year. Ideally I'd like each entry prefixed with a date in the format DD MON YYYY e.g. 09 SEP 2009.

Thanks

Jason

[Hakki Aydin Ucar]

/etc/syslog.conf configuration file allows the system administrator to specify where
the various systemsâ processes messages will get sent.

But not sure you can play the format and not necessary, just use a cronjob ; put a wrapper just periodically generate another file in another format from source /var/adm/syslog file as file convertor.

[Rita C Workman]

I've never tried it, but take a look at:

man logger

It says...logger command provdes a program interface to the syslog() system log module.

Rgrds,
Rita

[Bill Hassell]

Most syslog files are far too big to keep for more than a year. The format is fixed because syslog is a standard across multiple platforms (your syslog file does not have to be kept on your server). I would schedule your log rotation script to run at 0000 hours and check for a new year. Then use awk to read the old file and create a new one with the year added.

Personally, I do not like log dates with month names as they are painful to sort and compare. If I needed to search multiple logs over several years, I would convert the date to YYYYMMDD.HHMMSS (as in 20090909.140522) which will be easy to sort, especially across year end boundaries.