From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204 Description of problem: All the syslogs get confused in March, as some entrys begin with: Mar xx .... an d other with Mdr xx ....( Mdrz is german for March) During boottime, Mdr is used, otherwise Mar. This confuses log analyzers lite logwatch Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Select German Launguage during install 2. Wait till march 3. have a look at /var/log/messages Actual Results: Some log entris begin with Mdr, others with Mar Expected Results: All should begin with Mdr Additional info:
Ah ! This form does not support german special letters. Mdrz should be M ä rz in HTML.
It appears also in Japanese. (I checked it in RedHat 8.0) Probably syslog(3)(or syslog(2) cause this problem. Then this BUG should be assigned to glibc maintainer. Please check difference of below: $ export LANG=ja_JP.eucJP $ logger "message with syslog(3)" $ logger -d -u /dev/log "message without syslog(3)" $ tail -f /var/log/message | grep syslog _date(C locale)_ _host_ _date(ja locale)_ _username_: message with syslog(3) _date(C locale)_ _host_ _username_: message without syslog(3)
I'm sorry, bu I'm not familial with this bugzilla. Thus please change Assignment/Priority and the others. By RFC3164(ftp://ftp.rfc-editor.org/in-notes/rfc3164.txt), timestamp should be formatted as: The TIMESTAMP field is the local time and is in the format of "Mmm dd hh:mm:ss" (without the quote marks) where: Mmm is the English language abbreviation for the month of the year with the first character in uppercase and the other two characters in lowercase. The following are the only acceptable values: Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec but, on misc/syslog.c in glibc-2.2.93-5 line 170 are #ifdef USE_IN_LIBIO f->_IO_write_ptr += strftime (f->_IO_write_ptr, f->_IO_write_end - f->_IO_write_ptr, "%h %e %T ", __localtime_r (&now, &now_tm)); #else f->__bufp += strftime (f->__bufp, f->__put_limit - f->__bufp, "%h %e %T ", __localtime_r (&now, &now_tm)); #endif Then, this "%h" of this time format is wrong. Please change Status/Assignment and report to the upstream.
I think you should change this bug severity to "security" because it brakes some log analyzers/intrusion detection systems - for example logwatch.
This bug was already posted to the upstream(i.e. bug-glibc ML), but it was ignored. See also http://sources.redhat.com/ml/bug-glibc/2003-02/msg00064.html (http://sources.redhat.com/ml/bug-glibc/2003-02/msg00067.html) http://sources.redhat.com/ml/bug-glibc/2003-04/msg00116.html PLEASE change the "Component" field into "glibc". I have no permission to chane it.
The current glibc in FC1 and in the test version of the RHL errata at ftp://people.redhat.com/jakub/glibc/errata/2.3.2-27.9.4/ and the test version of the RHL8 errata at ftp://people.redhat.com/drepper/glibc-errata/rhel8/ has this fixed. We'll probably not going to fixed this for 7.2 since the patch cannot be backported. Try the errata versions if possible and let us know.
Closing as it is fixed in RHL9, FC1, and above. http://rhn.redhat.com/errata/RHSA-2003-325.html