up vote 0 down vote favorite
share [g+] share [fb]

Can you please tell me what can be the reason of log entries of /var/logs/secure be like this:

Mar 30 10:50:02 server2 proftpd: pam_unix(proftpd:session): session opened for user XXXXXXXXXXXXXX by (uid=0)
Mar 30 06:50:02 server2 proftpd[29432]: 127.0.0.1 (::ffff:93.91.7.90[::ffff:93.91.7.90]) - USER XXXXXXXXXXXXXX: Login successful.

How can one line be dated 10am and the next one 6am?

link|improve this question
88% accept rate
feedback

2 Answers

up vote 2 down vote accepted

Check your other logs to see if you find anything similar around the same timeframe. If so, your system clock could have changed dramatically. in that timeframe. If you are running ntp this isn't supposed to happen as it slews the clock gradually. However for example if someone ran `ntpdate ' and the clock was off by many hours, you would see a big time jump in the logs.

The other possibility is that your system was rebooted in the meantime, and the time got resynchronized on boot, leading to a time jump.

Inspecting your other logfiles like /var/log/messages should give you some more clues about how this happened.

link|improve this answer
Yes, there is the same in /var/xferlog for example. System clock works ok. ntpd is set up and working. uptime shows "up 145 days". In /var/log/messages I can see the same wierdos about time but only with proftpd entries. Others are quite correct. – FractalizeR Mar 30 '11 at 7:47
feedback
up vote 1 down vote

What timezone are you in? If there is more than one program writing to the same log file, they could be using different time formats. The two times in your example is probably two variants of the same time. Chances are you are 4 hours off from GMT.

Typically with FTP daemons I see this a lot. Some operations (login/connect) are logged in UTC, and some (file transfers) in local time. (Most often with [+0100] and [+0000] notation, though).

Could proftpd log some things through syslog, and write some things itself?

link|improve this answer
Here is GMT+3. But I don't understand how can proftpd write things into syslog files by itself and with its dates. How do I check that? – FractalizeR Mar 30 '11 at 9:02
@FractalizeR: you could start with strings `which proftpd` | grep secure. Could be PAM also? Maybe DST can explain the 4 instead of 3 hrs diff? – MattBianco Mar 30 '11 at 9:05
I've found something here proftpd.org/docs/howto/Timestamps.html Used SetEnv method. Will see how it goes. – FractalizeR Mar 30 '11 at 9:13
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.