Re: [RFC] changes to rsyslog - default to RFC 5424 format

[Scott Kitterman <debian@kitterman.com>]

On Tuesday, November 23, 2021 3:49:17 PM EST Simon Josefsson wrote:
> Michael Biebl <biebl@debian.org> writes:
> > Hi,
> > 
> > we are early in the bookworm release cycle, so I guess it's the
> > perfect time to bring up this topic.
> 
> Sorry for hijacking the thread, but perhaps now is a good time to stop
> using the legacy syslog time format and use the standardized RFC 5424
> format?  It is the default format in upstream rsyslog, but the default
> Debian config uses the legacy format.
> 
> Effectively, the change that I suggest is to stop putting this into
> /etc/rsyslog.conf by default:
> 
> #
> # Use traditional timestamp format.
> # To enable high precision timestamps, comment out the following line.
> #
> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
> 
> The legacy time format that is used today does not record year, timezone
> or subsecond information.  Compare /var/log/syslog outputs like this:
> 
> Nov 23 21:47:31 latte jas: test
> 
> with
> 
> 2021-11-23T21:47:49.082799+01:00 latte jas: test
> 
> /Simon

That seams like a reasonable change to make, but it should definitely be 
mentioned in NEWS for the package and the Debian release notes.

Scott K