BSD Syslog (RFC 3164)
datetime.timestamp.syslog_bsdLegacy syslog format from RFC 3164. No year component — year must be inferred from context. Day is space-padded. Extremely widespread in /var/log/syslog on Linux/BSD systems.
Worked samples
DuckDB 1.5.5 · finetype 0.6.64
| Value | As VARCHAR |
|---|---|
| Jan 15 14:30:00 | 2026-01-15 14:30:00 |
| Dec 31 23:59:59 | 2026-12-31 23:59:59 |
| Jun 1 08:15:30 | 2026-06-01 08:15:30 |
- %b
- abbreviated month name
- %-d
- day, no padding
- %H
- hour, 24-hour clock
- %M
- minutes
- %S
- seconds
Shape
^[A-Z][a-z]{2} [\s\d]\d \d{2}:\d{2}:\d{2}$| Value | Length | Shape |
|---|---|---|
| Jan 15 14:30:00 | 15 | matches |
| Dec 31 23:59:59 | 15 | matches |
| Jun 1 08:15:30 | 15 | matches |
| Jan 15 14:30:0 | 14 | rejected: one character short |
Background
Origin
Syslog was developed in the 1980s by Eric Allman as part of the Sendmail project.[1] Syslog originally functioned as a de facto standard, without any authoritative published specification.[1] RFC 3164 says the syslog protocol was originally developed on the University of California Berkeley Software Distribution (BSD) TCP/IP system implementations.[2]
RFC 3164, The BSD syslog Protocol, is an Informational RFC dated August 2001.[2] RFC 3164 was written by C. Lonvick of Cisco Systems.[2] RFC 3164 describes the observed behavior of the syslog protocol.[2] RFC 3164 states that it does not specify an Internet standard of any kind.[2]
RFC 3164 defines the TIMESTAMP field as local time in the format "Mmm dd hh:mm:ss".[2] RFC 3164 lists Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov and Dec as the only acceptable month values.[2] RFC 3164 gives the hour in a 24-hour format, with valid entries from 00 to 23.[2]
RFC 3164 reports that some syslog messages had been seen with a 2 character or 4 character year field immediately following the TIMESTAMP.[2] RFC 3164 suggests that implementers who want a more specific date and time stamp put it within the CONTENT field.[2]
RFC 5424, The Syslog Protocol, obsoletes RFC 3164.[3] RFC 5424 is a Standards Track document dated March 2009.[3] RFC 5424 says its TIMESTAMP field is a formalized timestamp derived from RFC 3339.[3]
Use
RFC 5424 says the TIMESTAMP described in RFC 3164 lacks the year and time zone information.[3] RFC 5424 suggests that when an RFC 3164 message is transformed into its format, the current year should be added.[3] RFC 3164 describes network administrators running a simple script to add the year to each stored record.[2] RFC 3164 also describes inserting a record into the log file that contains the current year, so that records near it are taken to be from that year.[2]
rsyslog's RFC 3164 parser, pmrfc3164, has a detect.YearAfterTimestamp option that treats a year following the timestamp as part of the timestamp instead of the hostname.[4]
Check whether a source writes a year after the timestamp before you parse the rest of the line. (Meridian's view)
Sources
- [1]Syslog - Wikipediasecondary source
- [2]The BSD syslog Protocolstandard
- [3]The Syslog Protocolstandard
- [4]pmrfc3164: RFC3164-formatted message parser - rsyslog 8 daily stable documentationdocumentation
Detection notes
New in format coverage expansion. No year in format — transform prepends current year. Day may be space-padded (e.g., " 1" for first of month). broad_type is VARCHAR because year inference makes DATE unreliable.
Use it
$ finetype infer -i "Jan 15 14:30:00" --mode column
→ datetime.timestamp.syslog_bsd
SELECT ft_infer('Jan 15 14:30:00');
-- → 'datetime.timestamp.syslog_bsd'strptime(CAST(YEAR(CURRENT_DATE) AS VARCHAR) || ' ' || {col}, '%Y %b %-d %H:%M:%S')
-- Format: %b %-d %H:%M:%SSchema
https://meridian.online/schemas/datetime.timestamp.syslog_bsd · Frictionless type datetime · any
finetype taxonomy datetime.timestamp.syslog_bsd -o json-schema