Add option -Z to syslogd(8) to use ISO 8601 timestamps

[Ian Lepore]

On Sun, 2018-04-01 at 18:24 +0800, Ben Woods wrote:
> My testing shows that if syslogd(8) is not running at the time a
> message
> comes in from syslog(3), the message is dropped (not buffered until
> syslogd
> is once again running).
> This means there would be no significant time delay issues causing
> incorrect timestamps if syslogd(8) adds the timestamp instead of
> syslog(3).
> https://svnweb.freebsd.org/base/head/lib/libc/gen/syslog.c?revision=3
> 26025&view=markup#l171

The important issue with source-side timestamping doesn't have to do
with whether syslogd is running or not, it has to do with mutiple
threads and processes feeding data to syslogd at high speed and
accurately timestamping the events being logged. Mutexes are involved
in libc syslog(3) for multithreaded apps, and buffers are involved
which can lead to arbitrary ordering of messages generated by various
processes, and only source-side timestamps can make it clear in what
order things really happened.

In addition, milliseconds are not nearly fine-grained enough for
fractional seconds.  Even microseconds aren't really good enough on
modern hardware.

-- Ian