@rgwood Let me know if anything should be changed or improved. Thank you!

Hi, thanks for the PR!

I don't think this addresses the core issue - which is that the time format in logs can vary across system. This will work on systems where the date is formatted in RFC3339, and not on others.

Might still be an improvement. I'm a little busy but will take a closer look when I can.

Thanks for reviewing the PR! In the code, we always pass --output=short-iso to journalctl, which produces consistent RFC3339/ISO 8601–style timestamps across systems:

Looking at the man page, --output=short-iso shows timestamps in the RFC 3339 profile of ISO 8601.

So, using NaiveDateTime::parse_from_str("%Y-%m-%d %H:%M:%S") maybe reliably parse these timestamps. I wanted to check if you’re okay with updating the PR this way, or if you’d prefer sticking to parse_from_rfc3339 for strict RFC compliance.

Take your time to review and let me know if you see any potential issues.

Right, I should have put more context in my initial issue. For reasons I don't fully understand, --output=short-iso doesn't seem to always work consistently.

On my laptop (Ubuntu 24.04, systemv v255):

2025-04-26T06:04:45-07:00 laptop anacron[31244]: Anacron 2.3 started on 2025-04-26

On an older server (Debian 11, systemd v247):

2025-10-06T11:07:44-0700 server dhcpcd[662]: wlan0: carrier acquired

I think this PR is an improvement (thank you! will probably merge it tonight) but I don't yet understand why journalctl is inconsistent like this.

Ah, I found the change: systemd/systemd#29134

Pushed a commit to make this work correctly on older systemd. Thanks for the PR!