LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (http://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   syslog time wrong - but date returns the correct time? (http://www.linuxquestions.org/questions/linux-newbie-8/syslog-time-wrong-but-date-returns-the-correct-time-700986/)

falc410 01-30-2009 05:55 AM

syslog time wrong - but date returns the correct time?
 
I have a weird problem with two RedHat 5 machines.

When I type date I get the correct time returned, but when I check the syslog all the times are one hour off.
I have searched the forums but I didn't really find a solution. When I create a new file, it also has the correct time, so it really only appears wrong in all the log files under /var/log which is very very annoying!

Now I have a ntp server configured and I think the hardware clock is fine, maybe it is a timezone problem, but I'm not sure.

I'm located in Germany, so that should be GMT+1.

The only thing I found which has anything to do with the timezone is /etc/sysconfing/clock and it looks like this:

ZONE="UTC"
UTC=true
ARC=false

I don't know if these are the correct values or not. Any help is appreciated.

pinniped 01-30-2009 07:55 AM

Are you confusing the system timestamps (UTC) with your local time? UNIX has historically used UTC for file timestamps (and almost everything else). Individual users can set their time zone on a per-process basis, so you can run multiple instances of 'pingus' each with a different time zone. Using local times to mark files etc just doesn't make any sense on any *NIX system. Even before UNIX, many computer applications (bank transactions, airline tickets, etc) involved multiple users from all over the planet performing operations on the computer. If someone updated data, how do you know when the last change was made? Simple - use a single time (UTC) for all transactions. If a user wanted to see results displayed in their own time zone, all they had to do was set the time zone appropriately and any timezone-aware program would adjust what the user sees.

falc410 01-30-2009 08:05 AM

Well I thank you for the explanation but I did only understand half of it.

I will try to explain my problem once more. Right now it is 2 pm in Germany. I log in to the server and run the following commands:

[root@nagios2 nagios]# date
Fri Jan 30 14:01:06 CET 2009
[root@nagios2 nagios]# wall test

Broadcast message from root (pts/0) (Fri Jan 30 13:01:18 2009)

Do you see the difference?
Funny thing is, depending on the software if I check /var/log/messages the timestamp is either correct or one hour off:

Jan 30 14:01:18 nagios2 wall[1636]: wall: user root broadcasted 1 lines (6 chars)

This is the correct time, but other software is sometimes one hour off, this causes quite a few problems. Here is a copy and paste of my /var/log/messages:

Quote:

Jan 30 12:07:54 nagios2 pengine: [3758]: info: process_pe_message: Configuration WARNINGs found during PE processing. Please
run "crm_verify -L" to identify issues.
Jan 30 13:08:20 nagios2 haclient: on_event:evt:cib_changed
Jan 30 13:08:20 nagios2 haclient: on_event:evt:cib_changed
Jan 30 13:08:20 nagios2 haclient: on_event: from message queue: evt:cib_changed
Jan 30 12:14:51 nagios2 cib: [3177]: info: cib_stats: Processed 104 operations (5000.00us average, 0% utilization) in the las
t 10min
Do you see what is happening? All those entries were in a timeframe of 7 minutes, but the logfiles recorded it with different hours, making the logfiles quite unreadable since you never can be sure what time it really was and you can't be sure if this happened in the right order or not.

jives11 05-27-2010 01:54 AM

I have the same issue.

I have a Mybookworld device running Linux and a laptop running Ubuntu Karmic Koala NBR which uses rsync to backup to the mybook at night. Works great

In the var/log/messages below you can see timed events happening - I run a script every 15 minutes to log the disk temperature in the Mybook. Then when the rsyncd entries appear they are dated 1 hour earlier, despite both the mybook and the laptop having the correct time and running ntp. 1 hour difference looks like a DST thing to me, but I cannot see where it's creeping in from


May 27 00:00:01 MyBookWorld cron.notice crond[1001]: USER root pid 31049 cmd date +%m%d%H%M%Y.%S > /var/lib/now
May 27 00:00:01 MyBookWorld cron.notice crond[1001]: USER root pid 31050 cmd /root/temp_log.sh >> /tmp/temperature.log
May 27 00:15:01 MyBookWorld local3.info rsyncd[31058]: connect from helen-laptop.lan
May 26 23:15:01 MyBookWorld local3.info rsyncd[31058]: rsync to helen-backup/ from JONATHAN@helen-laptop.lan
May 26 23:15:01 MyBookWorld local3.info rsyncd[31058]: receiving file list
May 27 00:15:01 MyBookWorld cron.notice crond[1001]: USER root pid 31060 cmd /root/temp_log.sh >> /tmp/temperature.log
May 26 23:15:01 MyBookWorld local3.info rsyncd[31058]: helen/
May 26 23:15:02 MyBookWorld local3.info rsyncd[31058]: helen/.config/google-chrome/
May 26 23:15:06 MyBookWorld local3.info rsyncd[31058]: helen/.config/google-chrome/Default/
May 26 23:16:10 MyBookWorld local3.info rsyncd[31058]: helen/.config/gtk-2.0/
May 26 23:16:13 MyBookWorld local3.info rsyncd[31058]: helen/.gconf/
May 26 23:16:22 MyBookWorld local3.info rsyncd[31058]: helen/.gconf/apps/nautilus/preferences/
May 26 23:16:23 MyBookWorld local3.info rsyncd[31058]: helen/.gconf/apps/update-manager/
May 26 23:16:23 MyBookWorld local3.info rsyncd[31058]: helen/.gconfd/
May 26 23:16:24 MyBookWorld local3.info rsyncd[31058]: helen/.gnome2/evince/
May 26 23:16:26 MyBookWorld local3.info rsyncd[31058]: helen/.kde/share/config/
May 26 23:16:26 MyBookWorld local3.info rsyncd[31058]: helen/.local/share/gvfs-metadata/
May 26 23:16:59 MyBookWorld local3.info rsyncd[31058]: helen/.openoffice.org/3/
May 26 23:16:59 MyBookWorld local3.info rsyncd[31058]: helen/.openoffice.org/3/user/backup/
May 26 23:16:59 MyBookWorld local3.info rsyncd[31058]: helen/.openoffice.org/3/user/registry/data/org/openoffice/Office/
May 26 23:16:59 MyBookWorld local3.info rsyncd[31058]: helen/.openoffice.org/3/user/uno_packages/cache/
May 26 23:16:59 MyBookWorld local3.info rsyncd[31058]: helen/Documents/
May 26 23:17:00 MyBookWorld local3.info rsyncd[31058]: helen/Downloads/

May 26 23:17:08 MyBookWorld local3.info rsyncd[31058]: sent 245623 bytes received 68083145 bytes total size 13103844678
May 27 00:30:02 MyBookWorld cron.notice crond[1001]: USER root pid 31076 cmd /root/temp_log.sh >> /tmp/temperature.log
May 27 00:45:01 MyBookWorld cron.notice crond[1001]: USER root pid 31091 cmd /root/temp_log.sh >> /tmp/temperature.log

vipspark 11-08-2013 04:34 AM

restart syslogd service.. I hope this will help you.

jpollard 11-09-2013 05:54 AM

It looks like /etc/sysconfing/clock is likely incorrect. This should be specifying the local time for the system - and instead it is defining UTC.

You can look here for some information about it:

http://www.centos.org/docs/5/html/5....fig-clock.html

I THINK you need a "zone" entry that defines your local time zone. After that, syslog should pick that up and use it to record time stamps.


All times are GMT -5. The time now is 04:29 PM.