On 18/12/2021 15:00, Michael Biebl wrote:
I'm not a user of logwatch, so I don't know, if logwatch nowadays can handle RFC 5424 timestamps, but even if so, I think the benefits outweigh the potential breakage. And it's easy enough for users to create a drop-in config snippet with $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat Such a snippet could even be shipped by packages like logwatch or logcheck, if they can't be fixed to support the newer timestamps.
It sounds like you're already going to do this anyway, but please include a commented out line in the config file for how to return to the previous format. For "normal" users, I think this change makes it harder to read and makes the lines longer for very little benefit.
Thanks, Roger