-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: ([0-9]{1,3}\.){3}[0-9]{1,3} local addr ([0-9]{1,3}\.){3}[0-9]{1,3} -> <null>
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ntpd\[[0-9]+\]: Soliciting pool server
+^[0-9]{4}-[0-9]{2}-[0-9]{2}T[ .:+0-9]+ [._[:alnum:]-]+ ntpd\[[0-9]+\]: ([0-9]{1,3}\.){3}[0-9]{1,3} local addr ([0-9]{1,3}\.){3}[0-9]{1,3} -> <null>
+^[0-9]{4}-[0-9]{2}-[0-9]{2}T[ .:+0-9]+ [._[:alnum:]-]+ ntpd\[[0-9]+\]: PROTO: ([0-9]{1,3}\.){3}[0-9]{1,3} unlink local addr ([0-9]{1,3}\.){3}[0-9]{1,3} -> <null>
+^[0-9]{4}-[0-9]{2}-[0-9]{2}T[ .:+0-9]+ [._[:alnum:]-]+ ntpd\[[0-9]+\]: Soliciting pool server