Hi, I notice that in the syslog-ng from my Debian install (2.0.9) log_msg_parse_date has p = strptime(self->date.str, "%Y-%m-%dT%H:%M:%S", &tm); and in 3.1beta2 I see p = (guchar *) strptime((gchar *) date, "%Y-%m-%d T%H:%M:%S", &tm); Is the extra space intended? I'm also wondering about a seeming ambiguity in RFC3339 [1] In 5.6 it says NOTE: ISO 8601 defines date and time separated by "T". Applications using this syntax may choose, for the sake of readability, to specify a full-date and full-time separated by (say) a space character. However in Appendix A it says ISO 8601 states that the "T" may be omitted under some circumstances. This grammar requires the "T" to avoid ambiguity. So is the T required or not? Should syslog-ng be able to parse either format? -i [1] http://www.ietf.org/rfc/rfc3339.txt