Configure rsyslog to specify the RFC 5424 protocol

Solution In Progress - Updated -

Environment

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • rsyslog

Issue

  • How to configure rsyslog to include timestamps which follow the guidelines outlined in ISO 8601-1:2019.

Resolution

To configure ryslog to include timestamps in the format specified by ISO 8601-1:2019, specify the use of the RFC 5424 protocol.

  1. Edit the /etc/rsyslog.conf file to change the default timestamp format.

For Red Hat Enterprise Linux 8, edit the following module line:

module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")

Change it to this:

module(load="builtin:omfile" Template="RSYSLOG_SyslogProtocol23Format")

For Red Hat Enterprise Linux 7, edit the following $ActionFileDefaultTemplate line:

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

Change it to this:

$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format
  1. Restart the rsyslog service.
systemctl restart rsyslog

Root Cause

The RFC 5424 log format enables rsyslog messages to include timestamps in the ISO 8601 format that follow the guidelines outlined in ISO 8601-1:2019.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments