Date formats are a nightmare.  Each event source may use a different convention, and some conventions are less than perfect.  For example, the date format used by syslog does not include a year.

Dates can also be entered in Orchids rules, by one of the following constructions:

• _CTIME(string constant)
• _TIMEVAL(string constant, integer constant)

The string constant is in a human-readable date format, and is parsed by the strptime() API call.  Unfortunately, the latter does not know how to parse a date without any further indication, and Orchids tries to parse it by using the following formats, one after the other.