diff --git a/includes/syslog.php b/includes/syslog.php
index e0fae7bfc..395e13a7a 100644
--- a/includes/syslog.php
+++ b/includes/syslog.php
@@ -55,7 +55,7 @@ function process_syslog($entry, $update) {
             // multipart message
             if(strpos($entry['msg'], ':') !== false) {
                 $matches = array();
-                $timestamp_prefix = '([A-Z][a-z]{2} \d\d? \d\d:\d\d:\d\d(.\d\d\d [A-Z]{3})?: )?';
+                $timestamp_prefix = '([A-Z][a-z]{2} \d\d? \d\d:\d\d:\d\d(.\d\d\d)?( [A-Z]{3})?: )?';
                 $program_match = '(?<program>%?[A-Za-z\d\-_]+(:[A-Z]* %[A-Z\d\-_]+)?)';
                 $message_match = '(?<msg>.*)';
                 if(preg_match('/^' . $timestamp_prefix . $program_match . ': ?' . $message_match . '/', $entry['msg'], $matches)) {
diff --git a/tests/SyslogTest.php b/tests/SyslogTest.php
index 6c3b25c19..a3c979767 100644
--- a/tests/SyslogTest.php
+++ b/tests/SyslogTest.php
@@ -61,6 +61,10 @@ class SyslogTest extends \PHPUnit_Framework_TestCase
             "1.1.1.1||local7||info||info||be||2016-04-27 021:12:28||Apr 27 21:12:28: %SYS-5-CONFIG_I: Configured from console by vty0||",
             array('device_id'=>1, 'program'=>'%SYS-5-CONFIG_I', 'msg'=>'Configured from console by vty0')
         );
+        $this->checkSyslog(
+            "1.1.1.1||local7||info||info||be||2016-04-27 021:12:28||Mar 8 20:14:08.762: %FACILITY-SUBFACILITY-SEVERITY-MNEMONIC: Message-text||000956",
+            array('device_id'=>1, 'program'=>'%FACILITY-SUBFACILITY-SEVERITY-MNEMONIC', 'msg'=>'Message-text')
+        );
 
 
         // ---- CatOS ----