The Developer's Handbook to Log Timestamps: Unix, ISO, RFC 3339, and How to Resolve Them

Log files use several different timestamp formats depending on the system, language, and logging framework involved. Understanding each format and how to convert it quickly is a practical skill for anyone who reads logs under pressure.

Unix timestamp (epoch time)

Format: a plain integer, e.g. 1741600200

Meaning: the number of seconds elapsed since 00:00:00 UTC on 1 January 1970, known as the Unix epoch. Some systems use milliseconds rather than seconds — a 13-digit integer (1741600200000) is milliseconds.

To convert: divide by 1000 if in milliseconds to get seconds, then use a converter or the command date -d @1741600200 on Linux/macOS. The result is 2026-03-10 14:30:00 UTC.

Advantages: compact, sortable, unambiguous, no DST issues. Disadvantages: not human-readable without conversion.

ISO 8601

Format: 2026-03-10T14:30:00Z or 2026-03-10T14:30:00+05:30

Meaning: covered in detail in the ISO 8601 guide in this learning centre. The key point for log parsing: always check the trailing character. Z means UTC. A numeric offset means local time with that offset. No trailing character is an ambiguous local time and should be treated with suspicion.

RFC 3339

Format: 2026-03-10T14:30:00+00:00

RFC 3339 is a profile of ISO 8601 used in internet protocols (HTTP, email, Atom feeds). It is nearly identical to ISO 8601 but requires an explicit timezone offset — no naked local times. The offset +00:00 is equivalent to Z. RFC 3339 timestamps are always unambiguous.

Syslog format

Format: Mar 10 14:30:00

This is the traditional syslog format defined in RFC 3164. It contains no year and no timezone information. The timezone is assumed to be the local timezone of the system that generated the log. When aggregating logs from systems in different timezones, syslog timestamps are unreliable without additional context. Prefer RFC 5424 syslog format which includes a full ISO 8601 timestamp with timezone.

Quick reference