On 2026/11/02 14:38, Christian Schulte wrote:
> Am 02.11.2026 um 14:16 schrieb Job Snijders:
> > On Mon, Nov 02, 2026 at 01:49:32PM +0100, Claudio Jeker wrote:
> >> I would love if syslogd would default to -Z. The default timestamps
> >> are just horrible to work with and lack sub second precision. Also the
> >> -Z output is a lot simpler to parse and convert.
> > 
> > Somewhat related: tools like ts(1) use strftime(3) for the format,
> > but strftime(3) does not provide an easy single character conversion
> > specification for ISO8601 timestamps. You have to do something like
> > 'echo hi | ts %Y-%m-%dT%H:%M:%SZ', which is a bit long.
> > 
> > Does anyone see some way to improve on this? Some options I considered:
> > 
> > Adding an extra option to ts(1) seems less desirable because it would
> > somewhat conflict with the interface people are used to.
> > 
> > Maybe just changing the default format in ts to '%Y-%m-%dT%H:%M:%SZ'
> > might be better?
> 
> Presenting something zulu which isn't is a recipe for disaster the same
> way as using %Z in strftime may yield something meaningless like
> "Mitteleuropäische Sommerzeit". Ring. Ring. Ring. What happened? It
> happened somewhen around twelve o'clock. Oh great I can grep the loghost
> about that time regardless of the timezone you are talking about because
> someone clever did not run syslogd on that loghost using the -Z command
> line option. Really. Do not use 'Z'. Use '%z'.

This sounds more like an argument for a time-aware grep than for changing
log format to me ;) (there is one in dateutils)