On Mon, Sep 07, 2026 at 06:37:41PM -0400, Mike wrote:
> 
> Note that I enable the I option when the Z option is specified, for 
> backward compatibility.

The ISO time requires the +0200 suffix to specify the time zone.
Don't change whitespaces in the comment.  It makes the diff larger
than needed.
Did you check what happens to the ISO time check when using remote
logging?
Does our remote looging receiver parse this timestamp correctly?
Why do you need the feature?  Just becase it looks nicer than UTC?

bluhm

> --- syslogd.8	Thu Jun 16 14:44:43 2022
> +++ syslogd.8	Mon Sep  7 17:51:25 2026
> @@ -104,6 +104,9 @@ the default is
>   .Pa /etc/syslog.conf .
>   .It Fl h
>   Include the hostname when sending messages to a remote loghost.
> +.It Fl I
> +Generate timestamps in ISO 8601 format: YYYY-MM-DDTHH:MM:SS.mmm
> +If the Z option is enabled, also indicate timezone by appending a Z.
>   .It Fl K Ar CAfile
>   PEM encoded file containing CA certificates used for client certificate
>   validation on the local listen socket.
> @@ -177,9 +180,8 @@ attacks over the network, including attackers remotely
>   Do not perform remote server certificate and hostname validation
>   when sending messages.
>   .It Fl Z
> -Generate timestamps in ISO format.
> -This includes the year and the timezone, and all logging is done
> -in UTC.
> +Use UTC for timestamps.  Enables the I option.
> +This includes the year and the timezone.
>   .El
>   .Pp
>   The options
> --- syslogd.c	Thu Jun 26 15:10:13 2025
> +++ syslogd.c	Mon Sep  7 17:36:42 2026
> @@ -230,7 +230,8 @@ int	PrivChild = 0;		/* Exec the privileged parent proc
>   int	Repeat = 0;		/* 0 msg repeated, 1 in files only, 2 never */
>   int	SecureMode = 1;		/* when true, speak only unix domain socks */
>   int	NoDNS = 0;		/* when true, refrain from doing DNS lookups */
> -int	ZuluTime = 0;		/* display date and time in UTC ISO format */
> +int	ISOformat = 0;		/* display date and time in ISO format (1) */
> +int	ZuluTime = 0;		/* display date and time in UTC (1) or local time (0) */
>   int	IncludeHostname = 0;	/* include RFC 3164 hostnames when forwarding */
>   int	Family = PF_UNSPEC;	/* protocol family, may disable IPv4 or IPv6 */
> 
> @@ -399,7 +400,7 @@ main(int argc, char *argv[])
>   	nbind = nlisten = ntls = 0;
> 
>   	while ((ch = getopt(argc, argv,
> -	    "46a:C:c:dFf:hK:k:m:nP:p:rS:s:T:U:uVZ")) != -1) {
> +	    "46a:C:c:dFf:hIK:k:m:nP:p:rS:s:T:U:uVZ")) != -1) {
>   		switch (ch) {
>   		case '4':		/* disable IPv6 */
>   			Family = PF_INET;
> @@ -431,6 +432,9 @@ main(int argc, char *argv[])
>   		case 'h':		/* RFC 3164 hostnames */
>   			IncludeHostname = 1;
>   			break;
> +		case 'I':		/* time stamps in ISO format */
> +			ISOformat = 1;
> +			break;
>   		case 'K':		/* verify client with CA file */
>   			ServerCAfile = optarg;
>   			break;
> @@ -480,8 +484,9 @@ main(int argc, char *argv[])
>   		case 'V':		/* do not verify certificates */
>   			NoVerify = 1;
>   			break;
> -		case 'Z':		/* time stamps in UTC ISO format */
> +		case 'Z':		/* timestamps in UTC time */
>   			ZuluTime = 1;
> +			ISOformat = 1;	/* backward compatibility */
>   			break;
>   		default:
>   			usage();
> @@ -1782,20 +1787,30 @@ struct timeval	now;
>   void
>   current_time(char *timestamp)
>   {
> +	struct tm *tm;
> +	size_t l;
> +
>   	(void)gettimeofday(&now, NULL);
> 
> -	if (ZuluTime) {
> -		struct tm *tm;
> -		size_t l;
> -
> +	if (ZuluTime)
>   		tm = gmtime(&now.tv_sec);
> -		l = strftime(timestamp, 33, "%FT%T", tm);
> +	else
> +		tm = localtime(&now.tv_sec);
> +
> +	l = strftime(timestamp, 33, "%FT%T", tm);
> +
> +	if (ISOformat)
> +	{
>   		/*
> -		 * Use only millisecond precision as some time has
> -		 * passed since syslog(3) was called.
> -		 */
> -		snprintf(timestamp + l, 33 - l, ".%03ldZ", now.tv_usec / 1000);
> -	} else
> +		* Use only millisecond precision as some time has
> +		* passed since syslog(3) was called.
> +		*/
> +		if (ZuluTime)
> +			snprintf(timestamp + l, 33 - l, ".%03ldZ", now.tv_usec / 1000);
> +		else
> +			snprintf(timestamp + l, 33 - l, ".%03ld", now.tv_usec / 1000);
> +	}
> +	else
>   		strlcpy(timestamp, ctime(&now.tv_sec) + 4, 16);
>   }
> 
> 
> 
> =fini=
> 
>