We recently upgraded (as in, backup, reinstall, selective restore) a couple of servers from CentOS-3.9 to CentOS-5.1. This generally went smoothly but we've encountered one confusing problem with syslog. Under CentOS-3, syslog entries were always dated in the host local timezone. With CentOS-5.1, they're dated in UTC *most* of the time, but occasionally in the local timezone. This has seriously confused a couple of our homegrown process monitoring scripts. The cron, secure, and maillog logs are all consistently in the local timezone ... it's only /var/log/messages that wanders around. It appears that any given process is consistent about which timezone it uses, but there's no obvious reason why any particular process gets the local zone vs. UTC. For example, we have a couple of long-running daemons that fork children to handle network requests, and although the parent daemon consistently logs in one timezone, its forks (which do not even do an exec, so they should be identical to the parent) randomly switch to the other timezone. What we'd like is for the local timezone always to be used as it was before. What configuration option or whatever, have we missed?
On Jan 11, 2008 2:51 PM, Bart Schaefer <barton.schaefer at gmail.com> wrote:> With CentOS-5.1, they're dated in UTC *most* of the time, > but occasionally in the local timezone. This has seriously confused a > couple of our homegrown process monitoring scripts.IIRC, the datestamp is put by the process that is logging, not by syslog itself. Maybe when that process started you hadn't configured the right /etc/localtime and the process still thinks it's running in UTC (processes read /etc/localtime only once). Did you try rebooting the machine to see if it solves the problem? Filipe -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.centos.org/pipermail/centos/attachments/20080111/55e5c979/attachment-0003.html>
On Jan 11, 2008 12:13 PM, Filipe Brandenburger <filbranden at gmail.com> wrote:> > IIRC, the datestamp is put by the process that is logging, not by syslog > itself. Maybe when that process started you hadn't configured the right > /etc/localtime and the process still thinks it's running in UTC (processes > read /etc/localtime only once).Our daemon is started after sendmail and before cron, and both the sendmail and cron log files use the local timezone, so ... Also there's the phenomenon of the timezone changing in what seems to be a random fashion when the process forks.> Did you try rebooting the machine to see if it solves the problem?It's been rebooted several times for other reasons. No change.