Changing the timestamp to localtime string representation is not possible, as it may break compatibility with existing log and reporting parsers. Though, there’s some hackery around converting this on the fly.

You may have figured that the old conversion regex for making the Unix timestamp in Icinga logs readable contained a bug

sudo cat /var/log/icinga/icinga.log | perl -p -e 's/^[(.*)]/"[". localtime($1) . "]"/e'

which is easily resolvable by using

sudo cat /var/log/icinga/icinga.log | perl -p -e 's/^[(d+)]/"[". localtime($1) . "]"/e'

Tip: You can use this even for the cmd.cgi Logging (cgi.cfg:use_logging=1) which is still tagged experimental, but adds a little more benefit for logging REMOTE_USER and REMOTE_ADDRESS when your users send commands through the Classic UI.

sudo cat /var/log/icinga/gui/icinga-cgi.log | perl -p -e 's/^[(d+)]/"[". localtime($1) . "]"/e'

I’ve also updated the wiki entry for the readable timestamps in Icinga logs.

%d bloggers like this: