RFC 3164 parser assumes timestamp in UTC

[RenaultAI]

Hi,

What are your thoughts on changing the syslog parser to either accept a timezone parameter or defaulting timezone to Local? Right now the RFC 3164 parser's timezone is hardcoded to UTC, and that will break for syslog clients that are not in the UTC zone. RFC 3164 suggests using the local timezone of the syslog client.

If the originally formed message has a TIMESTAMP in the HEADER
part, then it SHOULD be the local time of the device within its
timezone.

Thanks!

[abligh]

... and this has been a feature of RFC3164 which has been persistently criticised, because there is no definition of what 'local time' means, particularly if it's different for the sender and receiver. It also creates ambiguity issues when going into or out of DST (as the timezone is not transmitted it's impossible to know whether the date referred to was before or after the switch, which may straddle the transmission of the packet). This is why most implementations actually use (or should use) UTC.

I wouldn't object to being able to specify a timezone parameter (defaulting to UTC) but the default behaviour is I think correct.