I have noticed that my syslog reports incorrect time for some authentication entries. The typical behaviour looks like this:
Feb 16 13:32:20 dev sshd: Invalid user oracle from 18.104.22.168 Feb 16 12:32:20 dev sshd: input_userauth_request: invalid user oracle Feb 16 13:32:20 dev sshd: pam_unix(sshd:auth): check pass; user unknown Feb 16 13:32:20 dev sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22.214.171.124 Feb 16 13:32:20 dev sshd: pam_succeed_if(sshd:auth): error retrieving information about user oracle Feb 16 13:32:22 dev sshd: Failed password for invalid user oracle from 126.96.36.199 port 64368 ssh2 Feb 16 12:32:23 dev sshd: Received disconnect from 188.8.131.52: 11: Bye Bye
Notice how the hour swaps back and forth. Has anybody seen a similar behaviour? What might cause this? It seems systematic and it's the same entries for each connection attempt that are reported an hour earlier than they should be. System clock is GMT. Timezone GMT+1.