Wandering Thoughts archives

How to get (or recognize) a common Unix log timestamp format in things

One common form for timestamps in Unix log files is timestamps that come out looking like '2022-07-16 20:50:35', which is to say the date (in a sensible order) and then the time, with no timezone. Unless the program writing the logs is perverse, the timestamp is in the system's local time (whatever that is), not something fixed like UTC (of course the system's local timezone may be UTC). On a casual look around our systems, this is the timestamp format used by Exim and rspamd.

Go famously has a somewhat obscure approach to formatting and parsing timestamps, which pre-defines a number of common timestamp formats. However, this one is not one of them, and for reasons beyond the scope of this entry I recently wanted to recognize timestamps in this format in Go (more or less). To save myself looking this up in the future, the Go timestamp format for this is:

2006-01-02 15:04:05

(Since this timestamp doesn't have an explicit time zone, you'll probably want to specify one somehow so that your time.Time values get the right Location.)

A number of languages print and parse timestamps using a format based on the C strftime() and strptime() functions and their formatting (although the languages may not literally be using your C library functions for this). One example is Python's time.strftime. In strftime() formatting, this timestamp is:

%Y-%m-%d %H:%M:%S

Unsurprisingly, GNU Date accepts this as a date format in case you need to produce it in shell scripts. I believe that GNU Date will also automatically recognize it as an input time format for 'date -d ...'.

(My feeling is that this is a perfectly okay timestamp format. Yes, it omits the time zone, but I feel this is a sensible thing for logs written by a program in what is most likely a fixed time zone. One of our servers is pretty much guaranteed to never change its local time zone, and that local time zone is America/Toronto.)

PS: This is far from the only timestamp format found in the log files written out by various programs that don't send things to syslog, but it's the one I needed to deal with today and I lack the energy to inventory the time strings for all of them, even just in Go.