When sending a rfc5424 syslog message to OpenNMS, configured to use the Rfc5424SyslogParser
<85>1 2011-11-15T14:42:18+01:00 hostname sudo - - - pam_unix(sudo:auth): authentication failure; logname=username uid=0 euid=0 tty=/dev/pts/0 ruser=username rhost= user=username
OpenNMS would complain with the following error:
2011-11-15 14:09:00,573 DEBUG [SyslogConnection] Rfc5424SyslogParser: Unable to parse date string '2011-11-15T140916+0100'.
In Rfc5424SyslogParser.java (of 1.9.91) I found the following:
125 final String first = dateString.substring(0, dateString.lastIndexOf('-'));
126 final String last = dateString.substring(dateString.lastIndexOf('-'));
127 final String newString = first + last.replace(":", "");
It looks like one is trying to separate the string by a "-", which works fine as long as the time zone is negative, but not when it is prefixed by a "+". Then it would strip out all ":" from the timestamp.