Red Hat Bugzilla – Bug 61296
German translation: Syslog contains two date formats
Last modified: 2016-11-24 09:57:12 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204
Description of problem:
All the syslogs get confused in March, as some entrys begin with: Mar xx .... an
d other with Mdr xx ....( Mdrz is german for March) During boottime, Mdr is
used, otherwise Mar. This confuses log analyzers lite logwatch
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Select German Launguage during install
2. Wait till march
3. have a look at /var/log/messages
Actual Results: Some log entris begin with Mdr, others with Mar
Expected Results: All should begin with Mdr
Ah ! This form does not support german special letters. Mdrz should be M ä
rz in HTML.
It appears also in Japanese.
(I checked it in RedHat 8.0)
Probably syslog(3)(or syslog(2) cause this problem.
Then this BUG should be assigned to glibc maintainer.
Please check difference of below:
$ export LANG=ja_JP.eucJP
$ logger "message with syslog(3)"
$ logger -d -u /dev/log "message without syslog(3)"
$ tail -f /var/log/message | grep syslog
_date(C locale)_ _host_ _date(ja locale)_ _username_: message with syslog(3)
_date(C locale)_ _host_ _username_: message without syslog(3)
I'm sorry, bu I'm not familial with this bugzilla.
Thus please change Assignment/Priority and the others.
timestamp should be formatted as:
The TIMESTAMP field is the local time and is in the format of "Mmm dd
hh:mm:ss" (without the quote marks) where:
Mmm is the English language abbreviation for the month of the
year with the first character in uppercase and the other two
characters in lowercase. The following are the only acceptable
Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec
but, on misc/syslog.c in glibc-2.2.93-5 line 170 are
f->_IO_write_ptr += strftime (f->_IO_write_ptr,
f->_IO_write_end - f->_IO_write_ptr,
"%h %e %T ",
__localtime_r (&now, &now_tm));
f->__bufp += strftime (f->__bufp, f->__put_limit - f->__bufp,
"%h %e %T ", __localtime_r (&now, &now_tm));
Then, this "%h" of this time format is wrong.
Please change Status/Assignment and report to the upstream.
I think you should change this bug severity to "security" because it brakes some
log analyzers/intrusion detection systems - for example logwatch.
This bug was already posted to the upstream(i.e. bug-glibc ML),
but it was ignored.
PLEASE change the "Component" field into "glibc".
I have no permission to chane it.
The current glibc in FC1 and in the test version of the RHL errata at
and the test version of the RHL8 errata at
has this fixed. We'll probably not going to fixed this for 7.2 since
the patch cannot be backported. Try the errata versions if possible
and let us know.
Closing as it is fixed in RHL9, FC1, and above.