rsyslog

The rocket-fast system for log processing

Using a different log Format for all Files

Rsyslog comes with a limited set of log file formats. These resemble the default format that people (and log analyzers) usually expect. However, for some reason or another, it may be required to change the log format. In this recipe, we define a new format and use it as the default format for all log files.

Config Statements

$template myFormat,"%rawmsg%\n"
$ActionFileDefaultTemplate myFormat
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* /var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log

Things to think about

The template and ActionFileDefaultTemplate statements must be made at the top of the configuration file, before any of the files are specified.

How it works

The Template-statement defines the new format. It consist of fields to be written, potential modifications as well as literal text. In the sample config statement, "rawmsg" ist a property that contains the syslog message as it was received by rsyslogd ("received" from any source, for example a remote system or the local log socket). The string "\n" is a line feed (ASCII LF), a constant being added to the string. Usually, log line templates need to end with "\n", because without that, all log records would be written into a single line. Note that there are many fields and options for these fields that you can specify. The system is very flexible. But getting into the detail of all of that is beyond the scope of this cookbook-style book. Please see the "property replacer" official documentation for more details.

The $ActionFileDefaultTemplate then makes the newly defined template the default for all file actions. This saves you from specifying it with any single action line. But otherwise, it is equivalent to

$template myFormat,"%rawmsg%\n"
# The authpriv file has restricted access.
authpriv.*      /var/log/secure;myFormat
# Log all the mail messages in one place.
mail.*          /var/log/maillog;myFormat
# Log cron stuff
cron.*          /var/log/cron;myFormat
# Everybody gets emergency messages
*.emerg                                       *
# Save news errors of level crit and higher in a special file.
uucp,news.crit  /var/log/spooler;myFormat
# Save boot messages also to boot.log
local7.*        /var/log/boot.log;myFormat