Fix RFC 3339 vs RFC 3164 mixup for message format

ssahani · ssahani · commit fe49dd9a1752 · 2026-03-25T08:16:40.000+05:30
The message format was incorrectly referred to as RFC 3339 (a date/time format) throughout the codebase, when it should be RFC 3164 (the BSD syslog protocol). The timestamp formatting function format_rfc3339_timestamp() is left unchanged as it correctly formats timestamps per RFC 3339. Fixes: #144
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -47,7 +47,7 @@ systemd-netlogd is a network logging daemon that reads from the systemd journal
 │         │                                                   │
 │         ├──────► Protocol Layer                            │
 │         │         ├─► RFC 5424 Formatter                   │
-│         │         ├─► RFC 3339 Formatter                   │
+│         │         ├─► RFC 3164 Formatter                   │
 │         │         └─► RFC 5425 Formatter                   │
 │         │                                                   │
 │         └──────► Transport Layer                           │
@@ -77,8 +77,8 @@ systemd-netlogd is a network logging daemon that reads from the systemd journal
    │    └─► Extract timestamp
    │
    ├─► manager_push_to_network()
-   │    ├─► Select formatter (RFC 5424/3339)
-   │    ├─► format_rfc5424() or format_rfc3339()
+   │    ├─► Select formatter (RFC 5424/3164)
+   │    ├─► format_rfc5424() or format_rfc3164()
    │    │    ├─► Build priority field: <PRI> = (facility * 8) + severity
    │    │    ├─► Format timestamp (RFC 3339)
    │    │    ├─► Add hostname, identifier, pid
@@ -198,7 +198,7 @@ Example:
 <34>1 2024-01-20T10:30:15.123456+00:00 hostname myapp 1234 LOGIN001 [auth@12345] User logged in
 ```
 
-**RFC 3339 Format (Legacy):**
+**RFC 3164 Format (Legacy):**
 ```
 <PRI>TIMESTAMP HOSTNAME APP-NAME[PROCID]: MSG
 ```
@@ -489,6 +489,7 @@ Facilities that may contain credentials:
 
 - [RFC 5424](https://tools.ietf.org/html/rfc5424) - The Syslog Protocol
 - [RFC 5425](https://tools.ietf.org/html/rfc5425) - Transport Layer Security (TLS) Transport Mapping for Syslog
+- [RFC 3164](https://tools.ietf.org/html/rfc3164) - The BSD Syslog Protocol
 - [RFC 3339](https://tools.ietf.org/html/rfc3339) - Date and Time on the Internet: Timestamps
 - [RFC 6012](https://tools.ietf.org/html/rfc6012) - Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog
 - [systemd Journal](https://www.freedesktop.org/software/systemd/man/sd-journal.html)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -73,7 +73,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Initial release
 - UDP transport for syslog messages
-- RFC 3339 timestamp format
+- RFC 3164 message format
 - systemd journal integration
 - Multicast support
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -267,7 +267,7 @@ int main(void) {
 Aim for:
 - All new functions should have tests
 - Edge cases and error conditions
-- Protocol compliance (RFC 5424, RFC 3339)
+- Protocol compliance (RFC 5424, RFC 3164)
 
 ## Submitting Changes
 
@@ -418,7 +418,7 @@ perf report
 
 - [systemd Coding Style](https://systemd.io/CODING_STYLE/)
 - [RFC 5424](https://tools.ietf.org/html/rfc5424) - Syslog Protocol
-- [RFC 3339](https://tools.ietf.org/html/rfc3339) - Date and Time on the Internet
+- [RFC 3164](https://tools.ietf.org/html/rfc3164) - The BSD Syslog Protocol
 - [systemd Journal API](https://www.freedesktop.org/software/systemd/man/sd-journal.html)
 
 ## Getting Help
diff --git a/FAQ.md b/FAQ.md
@@ -184,7 +184,7 @@ TLSServerCertificate=/path/to/self-signed-cert.pem
 
 ## Log Formats
 
-### What's the difference between RFC 5424 and RFC 3339?
+### What's the difference between RFC 5424 and RFC 3164?
 
 **RFC 5424** (recommended):
 ```
@@ -194,7 +194,7 @@ TLSServerCertificate=/path/to/self-signed-cert.pem
 - Structured data support
 - Modern syslog standard
 
-**RFC 3339** (legacy):
+**RFC 3164** (legacy):
 ```
 <34>2024-01-20T10:30:15.123456+00:00 hostname myapp[1234]: User logged in
 ```
diff --git a/README.md b/README.md
@@ -75,7 +75,7 @@ journalctl -u systemd-netlogd -f
 - **🌐 Network-Aware**: Automatically detects network state changes via `sd-network`
 - **⚡ Zero Buffering**: Sequential journal reading without local caching
 - **🔒 Secure Transport**: UDP, TCP, TLS (RFC 5425), DTLS (RFC 6012)
-- **📋 Standard Formats**: RFC 5424 (recommended), RFC 3339 (legacy BSD syslog)
+- **📋 Standard Formats**: RFC 5424 (recommended), RFC 3164 (legacy BSD syslog)
 - **🎯 Smart Filtering**: Exclude sensitive facilities (auth/authpriv) and log levels
 - **📦 Namespace Support**: Forward from specific namespaces or aggregate all
 - **🛡️ Hardened**: Runs as unprivileged `systemd-journal-netlog` user with restricted capabilities
@@ -164,7 +164,7 @@ sudo systemctl enable --now systemd-netlogd
 |--------|-------------|---------|
 | **`Address=`** | Destination server (IP:port or multicast) | *Required* |
 | **`Protocol=`** | Transport: `udp`, `tcp`, `tls`, `dtls` | `udp` |
-| **`LogFormat=`** | Format: `rfc5424`, `rfc5425`, `rfc3339` | `rfc5424` |
+| **`LogFormat=`** | Format: `rfc5424`, `rfc5425`, `rfc3164` | `rfc5424` |
 | `ConnectionRetrySec=` | Retry interval on failure | `30s` |
 | `TLSCertificateAuthMode=` | TLS validation: `deny`, `warn`, `allow`, `no` | `deny` |
 | `TLSServerCertificate=` | Path to CA certificate PEM file | System CA |
@@ -178,7 +178,7 @@ sudo systemctl enable --now systemd-netlogd
 |--------|-------------|---------|
 | `Address=` | Destination (IP:port or multicast group) | **Required** |
 | `Protocol=` | `udp`, `tcp`, `tls`, `dtls` | `udp` |
-| `LogFormat=` | `rfc5424`, `rfc5425` (TLS), `rfc3339` (legacy) | `rfc5424` |
+| `LogFormat=` | `rfc5424`, `rfc5425` (TLS), `rfc3164` (legacy) | `rfc5424` |
 | `Directory=` | Custom journal directory path | System default |
 | `Namespace=` | Journal namespace: `*` (all), `+id` (id+default), `id` | Default |
 | `ConnectionRetrySec=` | Reconnect delay after failure | `30s` |
diff --git a/TESTING.md b/TESTING.md
@@ -43,7 +43,7 @@ Tests RFC 3339 timestamp formatting:
 #### test-string-tables
 Tests string table conversions:
 - Protocol names (udp, tcp, tls, dtls)
-- Log formats (rfc5424, rfc3339, rfc5425)
+- Log formats (rfc5424, rfc3164, rfc5425)
 - Syslog facilities (kern, user, mail, etc.)
 - Syslog levels (emerg, alert, crit, etc.)
 
diff --git a/doc/index.rst b/doc/index.rst
@@ -23,14 +23,14 @@ Synopsis
 Description
 -----------
 
-**systemd-netlogd** is a lightweight, network-aware daemon for forwarding log messages from the **systemd journal** to remote hosts over the network using the **Syslog protocol** (RFC 5424 and RFC 3339). It supports unicast and multicast destinations, ensuring efficient log aggregation in distributed environments.
+**systemd-netlogd** is a lightweight, network-aware daemon for forwarding log messages from the **systemd journal** to remote hosts over the network using the **Syslog protocol** (RFC 5424 and RFC 3164). It supports unicast and multicast destinations, ensuring efficient log aggregation in distributed environments.
 
 Key features:
 
 - **Efficient forwarding**: Reads journal entries sequentially and transmits them one-by-one without buffering or additional disk usage.
 - **Network integration**: Leverages ``sd-network`` to start forwarding when the network is up and pause when it's down.
 - **Secure transports**: Supports UDP (default), TCP, TLS, and DTLS (RFC 6012 for datagram security).
-- **Flexible output**: Formats logs as RFC 5424 (default), RFC 5425 (length-prefixed for TLS), or RFC 3339.
+- **Flexible output**: Formats logs as RFC 5424 (default), RFC 5425 (length-prefixed for TLS), or RFC 3164.
 - **Isolation**: Runs as the dedicated system user ``systemd-journal-netlog`` with minimal privileges.
 - **Filtering**: Exclude specific syslog facilities or levels; target specific journal namespaces.
 - **Fault tolerant**: Automatic reconnection with cursor persistence ensures no message loss.
@@ -113,7 +113,7 @@ Option                        Type    Default       Description
 ============================  ======  ============  ================================================================================================
 ``Address=``                  string  *(required)*  Destination (unicast ``IP:PORT`` or multicast ``GROUP:PORT``). See :manpage:`systemd.socket(5)`.
 ``Protocol=``                 enum    ``udp``       Transport protocol: ``udp``, ``tcp``, ``tls``, ``dtls``.
-``LogFormat=``                enum    ``rfc5424``   Message format: ``rfc5424`` (recommended), ``rfc5425`` (length-prefixed for TLS), ``rfc3339`` (legacy BSD syslog).
+``LogFormat=``                enum    ``rfc5424``   Message format: ``rfc5424`` (recommended), ``rfc5425`` (length-prefixed for TLS), ``rfc3164`` (legacy BSD syslog).
 ``Directory=``                path    *system*      Custom journal directory. Mutually exclusive with ``Namespace=``.
 ``Namespace=``                string  *default*     Journal namespace filter: specific ID, ``*`` (all namespaces), or ``+ID`` (ID plus default namespace).
 ``ConnectionRetrySec=``       time    ``30s``       Reconnect delay after connection failure (minimum 1s). See :manpage:`systemd.time(5)`.
@@ -147,14 +147,14 @@ UDP Multicast
    [Network]
    Address=239.0.0.1:6000
 
-Unicast UDP (RFC 3339)
+Unicast UDP (RFC 3164)
 ^^^^^^^^^^^^^^^^^^^^^^
 
 .. code-block:: ini
 
    [Network]
    Address=192.168.8.101:514
-   LogFormat=rfc3339
+   LogFormat=rfc3164
 
 Custom Structured Data
 ^^^^^^^^^^^^^^^^^^^^^^
@@ -717,6 +717,7 @@ See Also
 **RFCs and Standards:**
    - `RFC 5424 <https://tools.ietf.org/html/rfc5424>`_ - The Syslog Protocol
    - `RFC 5425 <https://tools.ietf.org/html/rfc5425>`_ - Transport Layer Security (TLS) Transport Mapping for Syslog
+   - `RFC 3164 <https://tools.ietf.org/html/rfc3164>`_ - The BSD Syslog Protocol
    - `RFC 3339 <https://tools.ietf.org/html/rfc3339>`_ - Date and Time on the Internet: Timestamps
    - `RFC 6012 <https://tools.ietf.org/html/rfc6012>`_ - Datagram Transport Layer Security (DTLS) Transport Mapping for Syslog
 
diff --git a/examples/development.conf b/examples/development.conf
@@ -7,7 +7,7 @@ Address=127.0.0.1:514
 Protocol=udp
 
 # Use legacy format for easier reading
-LogFormat=rfc3339
+LogFormat=rfc3164
 
 # Fast retry for development iteration
 ConnectionRetrySec=5
diff --git a/src/netlog/netlog-manager.c b/src/netlog/netlog-manager.c
@@ -30,7 +30,7 @@ DEFINE_STRING_TABLE_LOOKUP(protocol, SysLogTransmissionProtocol);
 static const char *const log_format_table[_SYSLOG_TRANSMISSION_LOG_FORMAT_MAX] = {
         [SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5424] = "rfc5424",
         [SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5425] = "rfc5425",
-        [SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3339] = "rfc3339",
+        [SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3164] = "rfc3164",
 };
 
 DEFINE_STRING_TABLE_LOOKUP(log_format, SysLogTransmissionLogFormat);
diff --git a/src/netlog/netlog-manager.h b/src/netlog/netlog-manager.h
@@ -24,7 +24,7 @@ typedef enum SysLogTransmissionProtocol {
 
 typedef enum SysLogTransmissionLogFormat {
         SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5424      = 1 << 0,
-        SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3339      = 1 << 1,
+        SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3164      = 1 << 1,
         SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5425      = 1 << 2,
         _SYSLOG_TRANSMISSION_LOG_FORMAT_MAX,
         _SYSLOG_TRANSMISSION_LOG_FORMAT_INVALID = -EINVAL,
diff --git a/src/netlog/netlog-network.c b/src/netlog/netlog-network.c
@@ -115,7 +115,7 @@ int manager_push_to_network(Manager *m,
         if (m->log_format == SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5424 || m->log_format == SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5425)
                r = format_rfc5424(m, severity, facility, identifier, message, hostname, pid, tv, syslog_structured_data, syslog_msgid);
         else
-               r = format_rfc3339(m, severity, facility, identifier, message, hostname, pid, tv);
+               r = format_rfc3164(m, severity, facility, identifier, message, hostname, pid, tv);
 
         if (r < 0)
                return r;
diff --git a/src/netlog/netlog-protocol.c b/src/netlog/netlog-protocol.c
@@ -194,7 +194,7 @@ static void set_priority_field(int severity, int facility, char *header_priority
         IOVEC_SET_STRING(iov[(*n)++], header_priority);
 }
 
-int format_rfc3339(Manager *m,
+int format_rfc3164(Manager *m,
                    int severity,
                    int facility,
                    const char *identifier,
@@ -211,7 +211,7 @@ int format_rfc3339(Manager *m,
         assert(m);
         assert(message);
 
-        /* RFC3339 format: <pri>timestamp hostname identifier[pid]: message */
+        /* RFC3164 format: <pri>timestamp hostname identifier[pid]: message */
         set_priority_field(severity, facility, header_priority, sizeof(header_priority), iov, &n);
         set_timestamp_field(tv, header_time, sizeof(header_time), iov, &n);
 
diff --git a/src/netlog/netlog-protocol.h b/src/netlog/netlog-protocol.h
@@ -8,5 +8,5 @@ int protocol_send(Manager *m, struct iovec *iovec, unsigned n_iovec);
 void format_rfc3339_timestamp(const struct timeval *tv, char *header_time, size_t header_size);
 int format_rfc5424(Manager *m, int severity, int facility, const char *identifier, const char *message, const char *hostname,
                    const char *pid, const struct timeval *tv, const char *syslog_structured_data, const char *syslog_msgid);
-int format_rfc3339(Manager *m, int severity, int facility, const char *identifier, const char *message, const char *hostname,
+int format_rfc3164(Manager *m, int severity, int facility, const char *identifier, const char *message, const char *hostname,
                    const char *pid, const struct timeval *tv);
diff --git a/src/netlog/systemd-netlogd.c b/src/netlog/systemd-netlogd.c
@@ -66,7 +66,7 @@ static int setup_cursor_state_file(Manager *m, uid_t uid, gid_t gid) {
 static void help(void) {
         printf("%s ..\n\n"
                "Forwards messages from the journal to other hosts over the network using the syslog\n"
-               "RFC 5424 or RFC3339 format in both unicast and multicast addresses.\n\n"
+               "RFC 5424 or RFC 3164 format in both unicast and multicast addresses.\n\n"
                "  -h --help                 Show this help\n"
                "     --version              Show package version\n"
                "     --cursor=CURSOR        Start at the specified cursor\n"
diff --git a/systemd-netlogd.spec b/systemd-netlogd.spec
@@ -27,7 +27,7 @@ Requires(postun): systemd
 
 %description
 Forwards messages from the journal to other hosts over the network
-using the Syslog Protocol (RFC 5424 and RFC 3339). It can be configured
+using the Syslog Protocol (RFC 5424 and RFC 3164). It can be configured
 to send messages to both unicast and multicast addresses.
 
 systemd-netlogd runs with its own user systemd-journal-netlog. It starts
diff --git a/tests/test-string-tables.c b/tests/test-string-tables.c
@@ -28,11 +28,11 @@ static void test_protocol_string_table(void **state) {
 /* Test log format string table conversions */
 static void test_log_format_string_table(void **state) {
         assert_string_equal(log_format_to_string(SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5424), "rfc5424");
-        assert_string_equal(log_format_to_string(SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3339), "rfc3339");
+        assert_string_equal(log_format_to_string(SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3164), "rfc3164");
         assert_string_equal(log_format_to_string(SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5425), "rfc5425");
 
         assert_int_equal(log_format_from_string("rfc5424"), SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5424);
-        assert_int_equal(log_format_from_string("rfc3339"), SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3339);
+        assert_int_equal(log_format_from_string("rfc3164"), SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_3164);
         assert_int_equal(log_format_from_string("rfc5425"), SYSLOG_TRANSMISSION_LOG_FORMAT_RFC_5425);
 
         /* Test invalid format - returns -1 when not found */
