Customer reported that the year is missing from the syslog timestamps.

While the logs contain the time and date, the absence of the year prevents proper data processing.

Syslog server will export data without year information. We can confirm that in PCAP.

It appears that when only the time-format option is configured, the logs follow the older RFC3164 format (without year).

When both  time-format and  structured-data are enabled together, the logs consistently include the year as expected.

Based on this, it seems that under the service-set (CGNAT), the time-format option alone may not be sufficient to enforce the desired timestamp format.

If we configure the “time-format” knob under my host and no “structured-data” knob under my syslog server. It goes with RFC3164  way and no year information. However, when structured-data is enabled, the logs switch to RFC5424 format, which includes the year in the timestamp.

We recommend testing by enabling structured data under system syslog using the below configuration:

set system syslog host <host-ip> structured-data