How to include millisecond in syslogs?

Question

I have configured rsyslog.conf file in /etc to include my own logs as syslogs in a file at /var/logs.

But after opening the file I got this:

Jun 5 10:09:09 lab-Altos-G330-Mk2 slog[19689]: Hello1
Jun 5 10:09:09 lab-Altos-G330-Mk2 slog[19689]: Hello2

Here, the timestamp only has second resolution. I want to know how to configure rsyslog to display milliseconds also?

Answer 1

By default, rsyslog uses traditional timestamp, which in date command's format would be:

%b %d %H:%M:%S

This is enabled by the following line in /etc/rsyslog.conf:

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat 

To enable high precision timestamping, comment out the line:

# $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat 

which will make rsyslog timestamping in the RFC 3339 format.

---

The RFC 3339 format can be simulated by the date command:

% date '+%Y-%m-%dT%H:%M:%S.%6N%:z'
2016-06-05T18:27:58.721607+06:00

Or even shorter:

% date '+%FT%T.%6N%:z'      
2016-06-05T18:29:32.569776+06:00

Or using the native --rfc-3399 option:

% date --rfc-3339=ns
2016-06-05 18:31:50.897557592+06:00

Answer 2

In /etc/rsyslog.conf, replace

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

with:

$template CustomFormat,"%timegenerated:1:10:date-rfc3339% %timegenerated:12:24:date-rfc3339% %syslogtag%%msg%\n"
$ActionFileDefaultTemplate CustomFormat

Now, if you logger test && tail -1 /var/log/syslog, you'd get:

2020-08-10 18:28:49.5397 user: test