From: Martijn van Duren <openbsd+tech@list.imperialat.at>
Subject: Re: syslogd: ISO8601 timestamp format in UTC by default
To: Rafael Sadowski <rafael@sizeofvoid.org>, tech@openbsd.org
Date: Mon, 2 Nov 2026 17:15:07 +0100

While I prefer the Z format format, the BSD format is specified by
RFC3164. So maybe it's a good idea to not remove it.

I don't mind the -B flag. As for your rephrasing of -Z, you're
saying "by default", but afaik there's no way to change the
timezone.

martijn@

On 11/2/26 17:02, Stuart Henderson wrote:
> On 2026/11/02 16:59, Rafael Sadowski wrote:
>> On Mon Nov 02, 2026 at 02:32:57PM +0000, Stuart Henderson wrote:
>>> newsyslog already unconditionally writes to the start of logs in this
>>> format, so I think it does make sense to change syslogd's default.
>>>
>>> as far as programs that parse logs go, I know sshguard and pflogsumm
>>> handle the -Z format... but there are likely to be a bunch of user-
>>> written scripts that won't. at least until we have more information
>>> about how bad that's going to be, I think it might be safer to flip
>>> the default, but give a way to move back, at least for a release or
>>> so...
>>>
>>
>> If I have understood you correctly, is that what you're thinking?
>> Is BSD format the correct working, B was free? Better naming, welcome.
> 
> Not sure what I'd call it... for an option letter I probably would have
> used -z (lowercase) as it's a bit more intuitive that it would be the
> opposite of -Z.
> 
>> Untested but I'm confident it will work.
>>
>> diff --git a/usr.sbin/syslogd/syslogd.8 b/usr.sbin/syslogd/syslogd.8
>> index 038be0574f3..b6cf4199fb5 100644
>> --- a/usr.sbin/syslogd/syslogd.8
>> +++ b/usr.sbin/syslogd/syslogd.8
>> @@ -173,12 +173,15 @@ mode, in which
>>  will accept input from the UDP port.
>>  Some software wants this, but you can be subjected to a variety of
>>  attacks over the network, including attackers remotely filling logs.
>> +.It Fl B
>> +Generate timestamps in the traditional BSD format.
>> +This option is deprecated and will be removed in a future release.
>>  .It Fl V
>>  Do not perform remote server certificate and hostname validation
>>  when sending messages.
>>  .It Fl Z
>> -Generate timestamps in ISO format.
>> -This includes the year and the timezone, and all logging is done
>> +This option is ignored and only accepted for backward compatibility.
>> +Timestamps are generated in ISO 8601 format in UTC by default.
>>  in UTC.
>>  .El
>>  .Pp
>> diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c
>> index af76ec2e181..9e36bb9771b 100644
>> --- a/usr.sbin/syslogd/syslogd.c
>> +++ b/usr.sbin/syslogd/syslogd.c
>> @@ -229,7 +229,8 @@ int	MarkSeq = 0;		/* mark sequence number */
>>  int	Repeat = 0;		/* 0 msg repeated, 1 in files only, 2 never */
>>  int	SecureMode = 1;		/* when true, speak only unix domain socks */
>>  int	NoDNS = 0;		/* when true, refrain from doing DNS lookups */
>> -int	ZuluTime = 0;		/* display date and time in UTC ISO format */
>> +/* XXX Remove ZuluTime once 8.1 has been released */
>> +int	ZuluTime = 1;		/* display date and time in UTC ISO format */
>>  int	IncludeHostname = 0;	/* include RFC 3164 hostnames when forwarding */
>>  int	Family = PF_UNSPEC;	/* protocol family, may disable IPv4 or IPv6 */
>>  
>> @@ -408,7 +409,7 @@ main(int argc, char *argv[])
>>  	nbind = nlisten = ntls = 0;
>>  
>>  	while ((ch = getopt(argc, argv,
>> -	    "46a:C:c:dFf:hK:k:m:np:rS:s:T:U:uVZ")) != -1) {
>> +	    "46a:C:c:dFf:hK:k:m:np:rS:s:T:U:uBVZ")) != -1) {
>>  		switch (ch) {
>>  		case '4':		/* disable IPv6 */
>>  			Family = PF_INET;
>> @@ -481,6 +482,9 @@ main(int argc, char *argv[])
>>  		case 'u':		/* allow udp input port */
>>  			SecureMode = 0;
>>  			break;
>> +		case 'B':		/* time stamps in BSD format */
>> +			ZuluTime = 0;
>> +			break;
>>  		case 'V':		/* do not verify certificates */
>>  			NoVerify = 1;
>>  			break;
>>
>