From: Mike <mmiller@mgm51.com>
Subject: patch for syslogd to enable option of ISO format in timestamps
To: tech@openbsd.org
Date: Mon, 7 Sep 2026 18:37:41 -0400


Note that I enable the I option when the Z option is specified, for 
backward compatibility.





--- syslogd.8	Thu Jun 16 14:44:43 2022
+++ syslogd.8	Mon Sep  7 17:51:25 2026
@@ -104,6 +104,9 @@ the default is
  .Pa /etc/syslog.conf .
  .It Fl h
  Include the hostname when sending messages to a remote loghost.
+.It Fl I
+Generate timestamps in ISO 8601 format: YYYY-MM-DDTHH:MM:SS.mmm
+If the Z option is enabled, also indicate timezone by appending a Z.
  .It Fl K Ar CAfile
  PEM encoded file containing CA certificates used for client certificate
  validation on the local listen socket.
@@ -177,9 +180,8 @@ attacks over the network, including attackers remotely
  Do not perform remote server certificate and hostname validation
  when sending messages.
  .It Fl Z
-Generate timestamps in ISO format.
-This includes the year and the timezone, and all logging is done
-in UTC.
+Use UTC for timestamps.  Enables the I option.
+This includes the year and the timezone.
  .El
  .Pp
  The options
--- syslogd.c	Thu Jun 26 15:10:13 2025
+++ syslogd.c	Mon Sep  7 17:36:42 2026
@@ -230,7 +230,8 @@ int	PrivChild = 0;		/* Exec the privileged parent proc
  int	Repeat = 0;		/* 0 msg repeated, 1 in files only, 2 never */
  int	SecureMode = 1;		/* when true, speak only unix domain socks */
  int	NoDNS = 0;		/* when true, refrain from doing DNS lookups */
-int	ZuluTime = 0;		/* display date and time in UTC ISO format */
+int	ISOformat = 0;		/* display date and time in ISO format (1) */
+int	ZuluTime = 0;		/* display date and time in UTC (1) or local time (0) */
  int	IncludeHostname = 0;	/* include RFC 3164 hostnames when forwarding */
  int	Family = PF_UNSPEC;	/* protocol family, may disable IPv4 or IPv6 */

@@ -399,7 +400,7 @@ main(int argc, char *argv[])
  	nbind = nlisten = ntls = 0;

  	while ((ch = getopt(argc, argv,
-	    "46a:C:c:dFf:hK:k:m:nP:p:rS:s:T:U:uVZ")) != -1) {
+	    "46a:C:c:dFf:hIK:k:m:nP:p:rS:s:T:U:uVZ")) != -1) {
  		switch (ch) {
  		case '4':		/* disable IPv6 */
  			Family = PF_INET;
@@ -431,6 +432,9 @@ main(int argc, char *argv[])
  		case 'h':		/* RFC 3164 hostnames */
  			IncludeHostname = 1;
  			break;
+		case 'I':		/* time stamps in ISO format */
+			ISOformat = 1;
+			break;
  		case 'K':		/* verify client with CA file */
  			ServerCAfile = optarg;
  			break;
@@ -480,8 +484,9 @@ main(int argc, char *argv[])
  		case 'V':		/* do not verify certificates */
  			NoVerify = 1;
  			break;
-		case 'Z':		/* time stamps in UTC ISO format */
+		case 'Z':		/* timestamps in UTC time */
  			ZuluTime = 1;
+			ISOformat = 1;	/* backward compatibility */
  			break;
  		default:
  			usage();
@@ -1782,20 +1787,30 @@ struct timeval	now;
  void
  current_time(char *timestamp)
  {
+	struct tm *tm;
+	size_t l;
+
  	(void)gettimeofday(&now, NULL);

-	if (ZuluTime) {
-		struct tm *tm;
-		size_t l;
-
+	if (ZuluTime)
  		tm = gmtime(&now.tv_sec);
-		l = strftime(timestamp, 33, "%FT%T", tm);
+	else
+		tm = localtime(&now.tv_sec);
+
+	l = strftime(timestamp, 33, "%FT%T", tm);
+
+	if (ISOformat)
+	{
  		/*
-		 * Use only millisecond precision as some time has
-		 * passed since syslog(3) was called.
-		 */
-		snprintf(timestamp + l, 33 - l, ".%03ldZ", now.tv_usec / 1000);
-	} else
+		* Use only millisecond precision as some time has
+		* passed since syslog(3) was called.
+		*/
+		if (ZuluTime)
+			snprintf(timestamp + l, 33 - l, ".%03ldZ", now.tv_usec / 1000);
+		else
+			snprintf(timestamp + l, 33 - l, ".%03ld", now.tv_usec / 1000);
+	}
+	else
  		strlcpy(timestamp, ctime(&now.tv_sec) + 4, 16);
  }



=fini=