# BSD Syslog (RFC 3164) Key: `datetime.timestamp.syslog_bsd` Legacy syslog format from RFC 3164. No year component — year must be inferred from context. Day is space-padded. Extremely widespread in /var/log/syslog on Linux/BSD systems. Page: Format: `%b %-d %H:%M:%S` Samples: `Jan 15 14:30:00`, `Dec 31 23:59:59`, `Jun 1 08:15:30` ## Background ### Origin Syslog was developed in the 1980s by Eric Allman as part of the Sendmail project.[[1]](https://en.wikipedia.org/wiki/Syslog) Syslog originally functioned as a de facto standard, without any authoritative published specification.[[1]](https://en.wikipedia.org/wiki/Syslog) RFC 3164 says the syslog protocol was originally developed on the University of California Berkeley Software Distribution (BSD) TCP/IP system implementations.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164, The BSD syslog Protocol, is an Informational RFC dated August 2001.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 was written by C. Lonvick of Cisco Systems.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 describes the observed behavior of the syslog protocol.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 states that it does not specify an Internet standard of any kind.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 defines the TIMESTAMP field as local time in the format "Mmm dd hh:mm:ss".[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 lists Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov and Dec as the only acceptable month values.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 gives the hour in a 24-hour format, with valid entries from 00 to 23.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 reports that some syslog messages had been seen with a 2 character or 4 character year field immediately following the TIMESTAMP.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 suggests that implementers who want a more specific date and time stamp put it within the CONTENT field.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 5424, The Syslog Protocol, obsoletes RFC 3164.[[3]](https://www.rfc-editor.org/rfc/rfc5424.txt) RFC 5424 is a Standards Track document dated March 2009.[[3]](https://www.rfc-editor.org/rfc/rfc5424.txt) RFC 5424 says its TIMESTAMP field is a formalized timestamp derived from RFC 3339.[[3]](https://www.rfc-editor.org/rfc/rfc5424.txt) ### Use RFC 5424 says the TIMESTAMP described in RFC 3164 lacks the year and time zone information.[[3]](https://www.rfc-editor.org/rfc/rfc5424.txt) RFC 5424 suggests that when an RFC 3164 message is transformed into its format, the current year should be added.[[3]](https://www.rfc-editor.org/rfc/rfc5424.txt) RFC 3164 describes network administrators running a simple script to add the year to each stored record.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) RFC 3164 also describes inserting a record into the log file that contains the current year, so that records near it are taken to be from that year.[[2]](https://www.rfc-editor.org/rfc/rfc3164.txt) rsyslog's RFC 3164 parser, pmrfc3164, has a detect.YearAfterTimestamp option that treats a year following the timestamp as part of the timestamp instead of the hostname.[[4]](https://docs.rsyslog.com/doc//configuration/modules/pmrfc3164.html) Check whether a source writes a year after the timestamp before you parse the rest of the line. (Meridian's view) ## Sources 1. [Syslog - Wikipedia](https://en.wikipedia.org/wiki/Syslog) — secondary source 2. [The BSD syslog Protocol](https://www.rfc-editor.org/rfc/rfc3164.txt) — standard 3. [The Syslog Protocol](https://www.rfc-editor.org/rfc/rfc5424.txt) — standard 4. [pmrfc3164: RFC3164-formatted message parser - rsyslog 8 daily stable documentation](https://docs.rsyslog.com/doc//configuration/modules/pmrfc3164.html) — documentation