10

I have a small server running centos 6.4 and it is working quite nicely for some time. One thing that still bugs me is that the time in my log files is different then the time the 'date' command displays.

For example:

date
Thu May  9 13:39:04 BST 2013

And when i login with ssh i get a log entry in secure log:

May  9 08:37:08 xxxx sshd[28612]: pam_unix(sshd:session): session opened for user root by

The time difference seem to be always 5 hours. Which makes me think it is something timezone related.

My hwclock

cat /etc/sysconfig/clock 
ZONE="Europe/London"

My localtime

ls -al /etc/localtime 
lrwxrwxrwx 1 root root 33 Apr  2 15:13 /etc/localtime -> /usr/share/zoneinfo/Europe/London

My hwclock output

hwclock
Thu 09 May 2013 01:41:40 PM BST  -0.938110 seconds

All time settings (i know of) are correct. I restarted the sshd service and cron service, but log files still have the wrong timezone.

It seem to happen on many log files like messages, secure, maillog. Only log files from simple programs like bfd, rkhunter and such have the correct time.

Has anybody got an idea what might be wrong?

  • 9
    Try restarting the syslog service. – Dennis Kaarsemaker May 9 '13 at 11:47
  • Thumbs up! It works, thank you for your very quick reply. /etc/init.d/rsyslog restart did solve the problem. – T. Akhayo May 9 '13 at 11:50
  • That one was news to me. Dennis, if you could write it as an answer with information about why it happens I'd be very interested. – Jenny D May 9 '13 at 12:09
  • 1
    Syslog caches the time when it boots up. It requires a restart to resync the time after a drift or dst or zone change. – Jesse Sep 28 '13 at 3:04
7

As Dennis pointed out try to restart syslog service. On centos 7 I did

systemctl restart rsyslog
1

I have found a solution. You need to download package tzdata:

yum install tzdata

and then restart asterisk, it will make logs time correct.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.