[CentOS] Syslog timezone issue

Bart Schaefer
Fri, 11 Jan 2008 19:51:41 -0000

We recently upgraded (as in, backup, reinstall, selective restore) a
couple of servers from CentOS-3.9 to CentOS-5.1.  This generally went
smoothly but we've encountered one confusing problem with syslog.

Under CentOS-3, syslog entries were always dated in the host local
timezone.  With CentOS-5.1, they're dated in UTC *most* of the time,
but occasionally in the local timezone.  This has seriously confused a
couple of our homegrown process monitoring scripts.

The cron, secure, and maillog logs are all consistently in the local
timezone ... it's only /var/log/messages that wanders around.

It appears that any given process is consistent about which timezone
it uses, but there's no obvious reason why any particular process gets
the local zone vs. UTC.  For example, we have a couple of long-running
daemons that fork children to handle network requests, and  although
the parent daemon consistently logs in one timezone, its forks (which
do not even do an exec, so they should be identical to the parent)
randomly switch to the other timezone.

What we'd like is for the local timezone always to be used as it was
before.  What configuration option or whatever, have we missed?