Suricata

I should add that using UTC timestamps without timezone is a sub-optimal solution because such knowledge has to be propagated to log collectors. To really make each event self-contained, the timestamp should include the timezone.

Alessandro Guido wrote:

I should add that using UTC timestamps without timezone is a sub-optimal solution because such knowledge has to be propagated to log collectors. To really make each event self-contained, the timestamp should include the timezone.

You mean something like '2000-01-01T00:00:00.000000+01:00' or '2000-01-01T00:00:00.0000000Z'?

I think this could be done relatively easily, especially when libc provides tm_gmtoff in struct tm.

'2000-01-01T00:00:00.000000+01:00' would be perfect

Alessandro Guido wrote:

'2000-01-01T00:00:00.000000+01:00' would be perfect

Ok, here goes the first attempt: https://github.com/inliniac/suricata/pull/1436
Hope it'll be accepted :)