From: Stuart Henderson <stu@spacehopper.org>
Subject: Re: syslogd: ISO8601 timestamp format in UTC by default
To: Rafael Sadowski <rafael@sizeofvoid.org>
Cc: tech@openbsd.org, Alexander Bluhm <bluhm@openbsd.org>
Date: Mon, 2 Nov 2026 16:02:11 +0000

On 2026/11/02 16:59, Rafael Sadowski wrote:
> On Mon Nov 02, 2026 at 02:32:57PM +0000, Stuart Henderson wrote:
> > newsyslog already unconditionally writes to the start of logs in this
> > format, so I think it does make sense to change syslogd's default.
> > 
> > as far as programs that parse logs go, I know sshguard and pflogsumm
> > handle the -Z format... but there are likely to be a bunch of user-
> > written scripts that won't. at least until we have more information
> > about how bad that's going to be, I think it might be safer to flip
> > the default, but give a way to move back, at least for a release or
> > so...
> > 
> 
> If I have understood you correctly, is that what you're thinking?
> Is BSD format the correct working, B was free? Better naming, welcome.

Not sure what I'd call it... for an option letter I probably would have
used -z (lowercase) as it's a bit more intuitive that it would be the
opposite of -Z.

> Untested but I'm confident it will work.
> 
> diff --git a/usr.sbin/syslogd/syslogd.8 b/usr.sbin/syslogd/syslogd.8
> index 038be0574f3..b6cf4199fb5 100644
> --- a/usr.sbin/syslogd/syslogd.8
> +++ b/usr.sbin/syslogd/syslogd.8
> @@ -173,12 +173,15 @@ mode, in which
>  will accept input from the UDP port.
>  Some software wants this, but you can be subjected to a variety of
>  attacks over the network, including attackers remotely filling logs.
> +.It Fl B
> +Generate timestamps in the traditional BSD format.
> +This option is deprecated and will be removed in a future release.
>  .It Fl V
>  Do not perform remote server certificate and hostname validation
>  when sending messages.
>  .It Fl Z
> -Generate timestamps in ISO format.
> -This includes the year and the timezone, and all logging is done
> +This option is ignored and only accepted for backward compatibility.
> +Timestamps are generated in ISO 8601 format in UTC by default.
>  in UTC.
>  .El
>  .Pp
> diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
> index af76ec2e181..9e36bb9771b 100644
> --- a/usr.sbin/syslogd/syslogd.c
> +++ b/usr.sbin/syslogd/syslogd.c
> @@ -229,7 +229,8 @@ int	MarkSeq = 0;		/* mark sequence number */
>  int	Repeat = 0;		/* 0 msg repeated, 1 in files only, 2 never */
>  int	SecureMode = 1;		/* when true, speak only unix domain socks */
>  int	NoDNS = 0;		/* when true, refrain from doing DNS lookups */
> -int	ZuluTime = 0;		/* display date and time in UTC ISO format */
> +/* XXX Remove ZuluTime once 8.1 has been released */
> +int	ZuluTime = 1;		/* display date and time in UTC ISO format */
>  int	IncludeHostname = 0;	/* include RFC 3164 hostnames when forwarding */
>  int	Family = PF_UNSPEC;	/* protocol family, may disable IPv4 or IPv6 */
>  
> @@ -408,7 +409,7 @@ main(int argc, char *argv[])
>  	nbind = nlisten = ntls = 0;
>  
>  	while ((ch = getopt(argc, argv,
> -	    "46a:C:c:dFf:hK:k:m:np:rS:s:T:U:uVZ")) != -1) {
> +	    "46a:C:c:dFf:hK:k:m:np:rS:s:T:U:uBVZ")) != -1) {
>  		switch (ch) {
>  		case '4':		/* disable IPv6 */
>  			Family = PF_INET;
> @@ -481,6 +482,9 @@ main(int argc, char *argv[])
>  		case 'u':		/* allow udp input port */
>  			SecureMode = 0;
>  			break;
> +		case 'B':		/* time stamps in BSD format */
> +			ZuluTime = 0;
> +			break;
>  		case 'V':		/* do not verify certificates */
>  			NoVerify = 1;
>  			break;
>