Couldn't you output the host and version at the beginning of the log? Any tool that transforms the logs (splicing together logs from different servers) should include these bits in it's output.
Also, why don't you use a sortable form for time? (With the most significant parts first.)
Also, why don't you use a sortable form for time? (With the most significant parts first.)