2.5.2. A note on timezones and timestamps The syslog-ng Premium Edition 7 Administrator Guide
If the clients run syslog-ng, then use the ISO timestamp, because it includes timezone information. That way you do not need to adjust the
recv-time-zone() parameter of syslog-ng.
If you want syslog-ng to output timestamps in Unix (POSIX) time format, use the
R_UNIXTIME macros. You do not need to change any of the timezone related parameters, because the timestamp information of incoming messages is converted to Unix time internally, and Unix time is a timezone-independent time representation. (Actually, Unix time measures the number of seconds elapsed since midnight of Coordinated Universal Time (UTC) January 1, 1970, but does not count leap seconds.)