Bug 1429009

Summary:	Fedora does use non-standard formats in its logs
Product:	[Fedora] Fedora	Reporter:	Roman Pavelka <rpavelka>
Component:	rsyslog	Assignee:	Radovan Sroka <rsroka>
Status:	CLOSED WONTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	dkopecek, jkurik, jlieskov, jvymazal, lkundrak, mah.darade, rsroka, tosykora
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-07-11 12:56:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Roman Pavelka 2017-03-03 19:41:29 UTC

In files like /var/log/messages, /var/log/cron and /var/log/secure, this format is used for a time:

Mar  3 20:01:36

This format has few disadvantages

1. Does not include year which sometimes may be needed, mostly when doing long term analysis or some investigation.

2. Does not include timezone which may be important piece when working with system scattered around the globe.

3. It is not standard format. Standard is ISO 8601.

I would propose to change this to defaults to standard format with timezone included.

Comment 1 Radovan Sroka 2017-03-30 11:40:12 UTC

You can create your custom template for that:

http://www.rsyslog.com/doc/v8-stable/configuration/templates.html

Comment 2 Roman Pavelka 2017-03-30 12:04:58 UTC

Radovan, thanks, I know about this possibility, but

1. people are ignorant and lazy and usually do not set up their systems up to standards for running global business (UTC, ISO 8601) even in case they do run one or few

  and

2. even more, they are able to set up new systems scattered around globe with here inspired logging time stamps and their only defense when confronted on this is (real quote) e.g.

> We've double-checked on the timestamps, and it's consistent with other syslogs.

> I can't think of a situation where we will look at year-old, or even months-old logs.

Purpose of this ticket is to slash and burn these unfortunate practices.

Comment 3 Radovan Sroka 2017-03-30 12:21:48 UTC

I agree with you.

I have to discuss that but it is possible to get this into f26. It is not an good idea to change default conf in stable fedoras.

Comment 4 Roman Pavelka 2017-03-30 12:25:28 UTC

Thank you, Radovan, for your effort on this, I highly appreciate it as I hit problems with this quite often...

I understand and completely agree with the point on stable releases.

Comment 5 Radovan Sroka 2017-04-26 10:25:26 UTC

Hi Roman,

I found out that this is not simple as I expected. It will be considered as system wide change which is quite complicated.

Comment 6 Roman Pavelka 2017-04-26 10:36:53 UTC

Thank you for update.

> It will be considered as system wide change which is quite complicated.

Well, the logging subsystem is system wide important so this is correct. 

However the change is worth of it IMHO as current state is not ideal at all.

Comment 7 Radovan Sroka 2017-07-11 12:56:08 UTC

This System Wide Change was dismissed by FESCO.

Wiki Page:
https://fedoraproject.org/wiki/Changes/RsyslogLogFormat

Closing this bug...