The syslog output uses a sprint pattern of "%{+MMM dd HH:mm:ss}". The sprintf code insert the date and time using a Joda DateTimeFormat, which in turn, I believe, uses this function. The text it inserts is locale specific. I am not aware of any locales where the short month name includes the period, but that is the only thing I can think of that cause two syslog outputs to produce different output.