diff --git a/usr.sbin/periodic/etc/daily/460.status-mail-rejects b/usr.sbin/periodic/etc/daily/460.status-mail-rejects
--- a/usr.sbin/periodic/etc/daily/460.status-mail-rejects
+++ b/usr.sbin/periodic/etc/daily/460.status-mail-rejects
@@ -36,8 +36,20 @@
 	    echo
 	    echo Checking for rejected mail hosts:
 
-	    yesterday=$(date -v-1d '+%b %e')
-	    today=$(date '+%b %e')
+		case "$(ps -o command= -p $(pgrep -j none -f /usr/sbin/syslogd) 2> /dev/null)" in
+			*-O\ syslog*|*-O\ rfc5424*)
+				yesterday="$(date -v-1d -I)"
+				today="$(date -I)"
+				prefix_yesterday="<[0-9]{1,3}>1 ${yesterday}T"
+				prefix_today="<[0-9]{1,3}>1 ${today}T"
+				;;
+			*)
+				yesterday="$(date -v-1d "+%b %e ")"
+				today="$(date "+%b %e ")"
+				prefix_yesterday="$yesterday"
+				prefix_today="$today"
+				;;
+		esac
 	    n=$(($daily_status_mail_rejects_logs - 2))
 	    rc=$({
 		while [ $n -ge 0 ]
@@ -61,7 +73,7 @@
 		    n=$(($n - 1))
 		done
 		cat /var/log/maillog
-	    } | sed -Ene "/^$today/q" -e "/^$yesterday/{"'
+	    } | sed -Ene "/^$prefix_today/q" -e "/^$prefix_yesterday/{"'
 		    s/.*ruleset=check_relay,.* relay=([^,]+), reject=([^ ]*).*/\2 check_relay \1/p
 		    t end
                     s/.*ruleset=check_rcpt,.* arg1=<?([^>,]+).* reject=([^ ]+) .* ([^ ]+)/\2 check_rcpt \1 \3/p
diff --git a/usr.sbin/periodic/etc/security/800.loginfail b/usr.sbin/periodic/etc/security/800.loginfail
--- a/usr.sbin/periodic/etc/security/800.loginfail
+++ b/usr.sbin/periodic/etc/security/800.loginfail
@@ -39,7 +39,16 @@
 
 LOG="${security_status_logdir}"
 
-yesterday=`date -v-1d "+%b %e "`
+case "$(ps -o command= -p $(pgrep -j none -f /usr/sbin/syslogd) 2> /dev/null)" in
+	*-O\ syslog*|*-O\ rfc5424*)
+		yesterday="$(date -v-1d -I)"
+		prefix="<[0-9]{1,3}>1 ${yesterday}T.*"
+		;;
+	*)
+		yesterday="$(date -v-1d "+%b %e ")"
+		prefix="$yesterday.*:"
+		;;
+esac
 
 catmsgs() {
 	find ${LOG} -name 'auth.log.*' -mtime -2 |
@@ -57,7 +66,7 @@
 then
 	echo ""
 	echo "${host} login failures:"
-	n=$(catmsgs | egrep -ia "^$yesterday.*: .*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" |
+	n=$(catmsgs | egrep -ia "^$prefix .*\b(fail(ures?|ed)?|invalid|bad|illegal|auth.*error)\b" |
 	    tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0
 fi
diff --git a/usr.sbin/periodic/etc/security/900.tcpwrap b/usr.sbin/periodic/etc/security/900.tcpwrap
--- a/usr.sbin/periodic/etc/security/900.tcpwrap
+++ b/usr.sbin/periodic/etc/security/900.tcpwrap
@@ -39,7 +39,16 @@
 
 LOG="${security_status_logdir}"
 
-yesterday=`date -v-1d "+%b %e "`
+case "$(ps -o command= -p $(pgrep -j none -f /usr/sbin/syslogd) 2> /dev/null)" in
+	*-O\ syslog*|*-O\ rfc5424*)
+		yesterday="$(date -v-1d -I)"
+		prefix="<[0-9]{1,3}>1 ${yesterday}T.*"
+		;;
+	*)
+		yesterday="$(date -v-1d "+%b %e ")"
+		prefix="$yesterday.*:"
+		;;
+esac
 
 catmsgs() {
 	find ${LOG} -name 'messages.*' -mtime -2 |
@@ -57,7 +66,7 @@
 then
 	echo ""
 	echo "${host} refused connections:"
-	n=$(catmsgs | grep -i "^$yesterday.*refused connect" |
+	n=$(catmsgs | egrep -ia "^$prefix .*refused connect" |
 	    tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0
 fi