Project

General

Profile

Actions
Copy link

Feature #1469

open
JM OD

Use ISO 8601 date/time formats

Feature #1469: Use ISO 8601 date/time formats

Added by James Moe over 11 years ago. Updated 15 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

suricata (as of 2.0.7) uses a date format that can be confusing. The log files have the US standard form "mm/dd/yyyy". However, when looking at the output of the "-v" option, the date form is "dd/mm/yyyy", a European preference, using slashes instead of dots. The ambiguity becomes obvious only when the day of month exceeds 12.

The feature request is an option in <suricata.yaml> to select a date format between its current form and an ISO 8601 form; my preference is "2015-05-13T09:00:24".

Reference: <https://en.wikipedia.org/wiki/ISO_8601>

Related issues 1 (1 open — 0 closed)

Related to Suricata - Optimization #1718: Time stamp in Log files should be ISO 8601 formatFeedbackCommunity TicketActions

AH Updated by Andreas Herz almost 11 years ago Actions
Copy link
 #1

  • Assignee set to OISF Dev
  • Target version set to TBD

VJ Updated by Victor Julien almost 9 years ago Actions
Copy link
 #2

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Richard Sailer
  • Target version changed from TBD to 70

I think it would be good to add support for the ISO form in console logging as well. CreateIsoTimeString() can be used in SCLogMessageGetBuffer() in util-debug. The messages are constructed based on a format string which defaults to SC_LOG_DEF_LOG_FORMAT. I would suggest adding a new format specifier.

AH Updated by Andreas Herz over 7 years ago Actions
Copy link
 #3

  • Assignee changed from Richard Sailer to OISF Dev

AH Updated by Andreas Herz over 7 years ago Actions
Copy link
 #4

VJ Updated by Victor Julien about 6 years ago Actions
Copy link
 #5

  • Target version changed from 70 to TBD

PA Updated by Philippe Antoine 3 months ago Actions
Copy link
 #6

  • Status changed from Assigned to Feedback

Is this not done ? See #1718 and I see `CreateIsoTimeString` in the code

JM Updated by James Moe about 1 month ago Actions
Copy link
 #7

See #1718 and I see `CreateIsoTimeString` in the code

How do I actually use it? Is it something that applies to all timestamped logs? Or is it specific to a log type?

JI Updated by Jason Ish about 1 month ago Actions
Copy link
 #8

James Moe wrote in #note-7:

See #1718 and I see `CreateIsoTimeString` in the code

How do I actually use it? Is it something that applies to all timestamped logs? Or is it specific to a log type?

It would help if you could point to which timestamp and which log files. Some are they way they are for legacy compatibility reasons.

JM Updated by James Moe 17 days ago Actions
Copy link
 #9

Jason Ish wrote in #note-8:

How do I actually use it? Is it something that applies to all timestamped logs? Or is it specific to a log type?

It would help if you could point to which timestamp and which log files.

fast.log
10/03/2026-21:17:03.910467 [Drop] [**] [1:2027758:5] ET DNS Query for .cc TLD [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 192.168.69.109:38064 -> 13.58.209.22:53

JI Updated by Jason Ish 15 days ago Actions
Copy link
 #10

James Moe wrote in #note-9:

Jason Ish wrote in #note-8:

How do I actually use it? Is it something that applies to all timestamped logs? Or is it specific to a log type?

It would help if you could point to which timestamp and which log files.

fast.log
10/03/2026-21:17:03.910467 [Drop] [**] [1:2027758:5] ET DNS Query for .cc TLD [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} 192.168.69.109:38064 -> 13.58.209.22:53

fast.log is a legacy format from Snort, arguably changing the format would break such that it is no longer "fast" log, but some other format.

I think a configuration option to change the format is a valid feature request, but it should be its own ticket.

Actions
Copy link

Also available in: PDF Atom