Re: Help logwatch and timestamp

Logwatch is not set up for a wholesale change of logging formats.  You'd
have to go through the respective service configuration file
("/usr/share/logwatch/default.conf/services") or logfile configuration
file ("/usr/share/logwatch/default.conf/logfiles") and specify the new
date configuration.  But don't change those files - as described in the
HOWTO-Customize-LogWatch file, you'd create a new corresponding file in
the /etc/logwatch/conf directory.  You'd do that for the log files
managed by rsyslogd.

The lines starting with '*' are the executable files.  A very common one
is *ApplyStdDate, to which you can pass a new argument with the new format.

(You could also try changing the default hard-coded inside the
applystddate script.  But that would break any services that use the
"standard" date format, but not controlled by rsyslogd - so you'd still
need to modify several services to use a new format parameter.)

I also noticed that you omitted the hostname, which is in the default
template.  If you really want to omit it, you'd also have to add a new
format parameter when you invoke *RemoveHeaders.

In summary, it is far easier to change if there is one specific service
for which you want a new format.  But changing rsyslogd to have a new
default is going to be arduous and error-prone.



On 3/1/20 12:03 PM, michael wrote:
> Hi,
> 
> I'm using logwatch on a new debian 10 install.
> 
> i've modified my timestamp in my rsyslog like this
> #$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> $template MicTemplate,"%$YEAR%-%$MONTH%-%$DAY%
> %timegenerated:12:19:date-rfc3339% %APP-NAME%:%msg%\n"
> $ActionFileDefaultTemplate MicTemplate
> 
> I've log like this:
> 2020-02-26 23:16:51 systemd:.....
> 
> Logwatch doesn't understand this. How can i patch logwatch to understand
> my template ?
> 
> Thanks for help.
> 
> 
> 
> _______________________________________________
> Logwatch-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/logwatch-devel