Modifying newsyslog on FreeBSD

Hoping that you won't be struggling like I have, some quick notes on newsyslog

TL;DR

# /etc/crontab - system crontab for FreeBSD

# Rotate log files every hour, if necessary.
0      *       *       *       *       root    newsyslog -t \%FT\%T

newsyslog timeformat

Modifying rc.conf is pointless
Crontab translates % into a new-line
Quoting matters

What did I set out to do

Change the filenames to include a timestamp instead of a counter.

In normal operation, you'd find in your /var/log directory

auth.log
auth.log.0
auth.log.1
...

and I like it better when these are

auth.log
auth.log.2026-08-12T00:00:00
auth.log.2026-08-11T00:00:00
...

You know, RFC 3339 or GTFO! No TZ, systems run in UTC!

The newsyslog manpage shows that you need to use -t *timefmt* for that.

`/etc/rc.conf`

As there's a newsyslog script in /etc/rc.d I used /etc/rc.conf to get to that.

newsyslog_flags="-t '%FT%T'"

This will do absolutely nothing, everything works as before. So you get .0, 1 etc.

`/etc/crontab`

newsyslog is invoked by cron (not rc)

# Rotate log files every hour, if necessary.
0      *       *       *       *       root    newsyslog

Note: You can omit the minutes:seconds from your time formatting with the default config!

So, I modified the main crontab and added some testing (cron being configured to send output to my mail)

# Rotate log files every hour, if necessary.
*/5      *       *       *       *       root    newsyslog -nv -t '%FT%T'

Which should result in desired filenames.

NOPE!

Now you get emails from cron with subject

newsyslog -nv -t '

What?!!!

More digging, crontab fileformat manpage

Percent-signs (%) in the command, unless escaped with backslash (), will be changed into newline characters, and all data after the first % will be sent to the command as standard input.

So, the correct crontab line is

# Rotate log files every hour, if necessary.
*/5      *       *       *       *       root    newsyslog -nv -t '\%FT\%T'

Quoting

Ended up with logfiles named

auth.log
auth.log.'2026-08-12T00:00:00'
auth.log.'2026-08-11T00:00:00'
...

Drop the quotes in the crontab line

TL;DR

Ended up with the following in crontab

# Rotate log files every hour, if necessary.
0      *       *       *       *       root    newsyslog -t \%FT\%T