Fedora 11 has different date format from logfiles compared to FC 6-10

Linux and Unix-Like Red Hat
1

Hi Gurus,

Is there a way to tweak the date format in /var/log/secure (Fedora 11) so that it will have the same date format as in Fedora ver. 6-10.

For Fedora 11:

2010-01-24T07:32:03.767801+09:00 jump sshd[31647]: Failed password for root from 189.1.164.92 port 47662 ssh2
2010-01-24T07:32:08.391785+09:00 jump sshd[31649]: Failed password for root from 189.1.164.92 port 48117 ssh2
2010-01-24T07:32:13.156278+09:00 jump sshd[31651]: Failed password for root from 189.1.164.92 port 48486 ssh2
2010-01-24T07:32:18.081482+09:00 jump sshd[31653]: Failed password for root from 189.1.164.92 port 48781 ssh2

For Fedora 6-10:

Jan 24 04:39:36 kickstart CROND[17538]: pam_unix(crond:session): session closed for user munin
Jan 24 04:40:01 kickstart crond[28413]: pam_succeed_if(crond:account): requirement "uid < 100" was met by user "root"
Jan 24 04:40:01 kickstart crond[28413]: pam_unix(crond:session): session opened for user root by (uid=0)
Jan 24 04:40:06 kickstart crond[28414]: pam_succeed_if(crond:account): requirement "uid < 100" not met by user "munin"
Jan 24 04:40:06 kickstart CROND[28413]: pam_unix(crond:session): session closed for user root
2

I am on Fedora 12 and it still uses the same date format as Fedora 10 and earlier releases.

Check that the /etc/rsyslogd.conf is set to use RSYSLOG_TraditionalFileFormat, i.e

$ActionFileDefaulttemplate RSYSLOG_TraditionalFileFormat
3

Hi fpmurphy,

Thanks for the insight.. It also needs to update the rsyslog package to from 3.21 to 3.22 and adding the lines you have mentioned.

Thanks..this forum helps me a lot.

4

After upgrading the rsyslog package to 3.22 and adding the line in /etc/rsyslog.conf

$ActionFileDefaulttemplate RSYSLOG_TraditionalFileFormat

still doesnt work in our production system using this kernel:

[root@jump ~]# uname -a 
Linux jump.valuecommerce.com 2.6.29.5-191.fc11.i686.PAE #1 SMP Tue Jun 16 23:19:53 EDT 2009 i686 i686 i386 GNU/Linux

[root@adminj ~]# uname -a
Linux adminj 2.6.30.5-43.fc11.x86_64 #1 SMP Thu Aug 27 21:39:52 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux

here is the logs from /var/log/messages:

Feb  9 14:58:09 adminj rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your config and adding -c3 as the first rsyslogd option.
Feb  9 14:58:09 adminj rsyslogd: Warning: backward compatibility layer added to following directive to rsyslog.conf: ModLoad imuxsock

---------- Post updated at 02:33 PM ---------- Previous update was at 01:57 PM ----------

[/COLOR]Sorry, i already figured it out. it is now working.

Thanks.