sequence

Time Formats

One of the most difficult task in log parsing is recognizing and understanding the different time formats. Syslog RFCs have defined a couple formats that the syslog servers abide to. However, there are many log messages out there that don’t use the two syslog time formats.

sequence currently automatically recognizes 42 different time formats as listed below. More will be added, so the best (authoritative) place to check is sequence.toml in the github repo.

When writing rules, analysts don’t need to know what time formats are used in the log messages. They just need to know that there’s a time at a certain location of the message. sequence will automatically detecting the time format, and normalizing the time formats into a single one.

In the table below, the reference time used in the layouts is the specific time:

Mon Jan 2 15:04:05 MST 2006

which is Unix time 1136239445. Since MST is GMT-0700, the reference time can be thought of as

01/02 03:04:05PM '06 -0700

The best way to remember this is that the numbers are contiguous: 01, 02, 03, 04, 05, 06, 07 in the above format. Make sure you write the time format correctly as it will be used to normalize the different time stamps.