Okay - this one has me stumped. We have 2 RH 9 servers set up that both had the timestamp in the messages log jump by 1 day for an hour, then jump back.

/var/log/messages is moving along fine at 16:01:01 on Apr 5. Then it jumps to 16:00:49 on the 6th. Continues to be the 6th for one hour - logs look normal besides the date. Then at 17:00:58 on Apr 6 it jumps to Apr5 17:01:15.

Both systems did the same thing. (They were set up before I got here, so I don't know all the details.)

Any ideas or suggestions? Have they been compromised?
(They only run sshd, snmpd v2 and our own private application.)
Thanks,
Eric

Does it sync using ntp?

No - not using NTP. We are talking about turning that on - but this change is really odd.

We did find a cron where both systems were syncing to our ISP on the hour - perhaps there was a problem on their end. Unfortunately I'm not sure that I can confirm.