From: Rafael Sadowski <rafael@sizeofvoid.org>
Subject: Re: syslogd: ISO8601 timestamp format in UTC by default
To: tech@openbsd.org, Alexander Bluhm <bluhm@openbsd.org>
Date: Mon, 2 Nov 2026 16:59:15 +0100

On Mon Nov 02, 2026 at 02:32:57PM +0000, Stuart Henderson wrote:
> newsyslog already unconditionally writes to the start of logs in this
> format, so I think it does make sense to change syslogd's default.
> 
> as far as programs that parse logs go, I know sshguard and pflogsumm
> handle the -Z format... but there are likely to be a bunch of user-
> written scripts that won't. at least until we have more information
> about how bad that's going to be, I think it might be safer to flip
> the default, but give a way to move back, at least for a release or
> so...
> 

If I have understood you correctly, is that what you're thinking?
Is BSD format the correct working, B was free? Better naming, welcome.

Untested but I'm confident it will work.

diff --git a/usr.sbin/syslogd/syslogd.8 b/usr.sbin/syslogd/syslogd.8
index 038be0574f3..b6cf4199fb5 100644
--- a/usr.sbin/syslogd/syslogd.8
+++ b/usr.sbin/syslogd/syslogd.8
@@ -173,12 +173,15 @@ mode, in which
 will accept input from the UDP port.
 Some software wants this, but you can be subjected to a variety of
 attacks over the network, including attackers remotely filling logs.
+.It Fl B
+Generate timestamps in the traditional BSD format.
+This option is deprecated and will be removed in a future release.
 .It Fl V
 Do not perform remote server certificate and hostname validation
 when sending messages.
 .It Fl Z
-Generate timestamps in ISO format.
-This includes the year and the timezone, and all logging is done
+This option is ignored and only accepted for backward compatibility.
+Timestamps are generated in ISO 8601 format in UTC by default.
 in UTC.
 .El
 .Pp
diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
index af76ec2e181..9e36bb9771b 100644
--- a/usr.sbin/syslogd/syslogd.c
+++ b/usr.sbin/syslogd/syslogd.c
@@ -229,7 +229,8 @@ int	MarkSeq = 0;		/* mark sequence number */
 int	Repeat = 0;		/* 0 msg repeated, 1 in files only, 2 never */
 int	SecureMode = 1;		/* when true, speak only unix domain socks */
 int	NoDNS = 0;		/* when true, refrain from doing DNS lookups */
-int	ZuluTime = 0;		/* display date and time in UTC ISO format */
+/* XXX Remove ZuluTime once 8.1 has been released */
+int	ZuluTime = 1;		/* display date and time in UTC ISO format */
 int	IncludeHostname = 0;	/* include RFC 3164 hostnames when forwarding */
 int	Family = PF_UNSPEC;	/* protocol family, may disable IPv4 or IPv6 */
 
@@ -408,7 +409,7 @@ main(int argc, char *argv[])
 	nbind = nlisten = ntls = 0;
 
 	while ((ch = getopt(argc, argv,
-	    "46a:C:c:dFf:hK:k:m:np:rS:s:T:U:uVZ")) != -1) {
+	    "46a:C:c:dFf:hK:k:m:np:rS:s:T:U:uBVZ")) != -1) {
 		switch (ch) {
 		case '4':		/* disable IPv6 */
 			Family = PF_INET;
@@ -481,6 +482,9 @@ main(int argc, char *argv[])
 		case 'u':		/* allow udp input port */
 			SecureMode = 0;
 			break;
+		case 'B':		/* time stamps in BSD format */
+			ZuluTime = 0;
+			break;
 		case 'V':		/* do not verify certificates */
 			NoVerify = 1;
 			break;