/etc/rsyslog.conf
# local timestamp template $template LocalTimeTraditionalFileFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $template LocalTimeFileFormat,"%timegenerated:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $ActionFileDefaultTemplate LocalTimeTraditionalFileFormat #$ActionFileDefaultTemplate LocalTimeFileFormat