Manually changing a server machine's clock
 

Does anyone know if there is any indication in OS Syslog that the guest's clock has been recently "manually" changed?

I understand that if it is changed by NTP there is a record of the change in the OS Syslog, but is this also true if the clock is changed manually?

Jim4522

not typically no.

I'd think that Chis is right but it may assume some stuff.

A local change might be reported or left traces of by some means. If in shell history or maybe even some bios's reporting time or looking at logs that seem to be out of whack based on order or some other file oddities.

Some good attacker could have wiped all that.