Bug 61296 - German translation: Syslog contains two date formats
German translation: Syslog contains two date formats
Product: Red Hat Linux
Classification: Retired
Component: glibc (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jakub Jelinek
Brian Brock
: Security
Depends On:
  Show dependency treegraph
Reported: 2002-03-16 09:27 EST by Tobias Edler
Modified: 2016-11-24 09:57 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2003-12-12 04:24:52 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Tobias Edler 2002-03-16 09:27:22 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204

Description of problem:
All the syslogs get confused in March, as some entrys begin with: Mar xx .... an
d other with Mdr xx ....( Mdrz is  german for March) During boottime, Mdr is
used, otherwise Mar. This confuses log analyzers lite logwatch

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Select German Launguage during install
2. Wait till march
3. have a look at /var/log/messages

Actual Results:  Some log entris begin with Mdr, others with Mar

Expected Results:  All should begin with Mdr

Additional info:
Comment 1 Tobias Edler 2002-03-16 09:34:46 EST
Ah ! This form does not support german special letters. Mdrz should be M ä
rz in HTML. 
Comment 2 SEKINE Tatsuo 2003-02-24 03:37:55 EST
It appears also in Japanese.
(I checked it in RedHat 8.0)

Probably syslog(3)(or syslog(2) cause this problem.
Then this BUG should be assigned to glibc maintainer.

Please check difference of below:

$ export LANG=ja_JP.eucJP
$ logger "message with syslog(3)"
$ logger -d -u /dev/log "message without syslog(3)"
$ tail -f /var/log/message | grep syslog
_date(C locale)_ _host_ _date(ja locale)_ _username_: message with syslog(3)
_date(C locale)_ _host_ _username_: message without syslog(3)

Comment 3 SEKINE Tatsuo 2003-02-24 13:05:17 EST
I'm sorry, bu I'm not familial with this bugzilla.
Thus please change Assignment/Priority and the others.

By RFC3164(ftp://ftp.rfc-editor.org/in-notes/rfc3164.txt),
timestamp should be formatted as:

   The TIMESTAMP field is the local time and is in the format of "Mmm dd
   hh:mm:ss" (without the quote marks) where:

         Mmm is the English language abbreviation for the month of the
         year with the first character in uppercase and the other two
         characters in lowercase.  The following are the only acceptable

         Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep, Oct, Nov, Dec

 but, on misc/syslog.c in glibc-2.2.93-5 line 170 are

  #ifdef USE_IN_LIBIO
            f->_IO_write_ptr += strftime (f->_IO_write_ptr,
                                          f->_IO_write_end - f->_IO_write_ptr,
                                          "%h %e %T ",
                                          __localtime_r (&now, &now_tm));
            f->__bufp += strftime (f->__bufp, f->__put_limit - f->__bufp,
                                   "%h %e %T ", __localtime_r (&now, &now_tm));

Then, this "%h" of this time format is wrong.

Please change Status/Assignment and report to the upstream.
Comment 4 Tomasz Ostrowski 2003-03-10 08:14:29 EST
I think you should change this bug severity to "security" because it brakes some
log analyzers/intrusion detection systems - for example logwatch.
Comment 5 SEKINE Tatsuo 2003-09-16 08:14:57 EDT
This bug was already posted to the upstream(i.e. bug-glibc ML),
but it was ignored.
See also

PLEASE change the "Component" field into "glibc".
I have no permission to chane it.
Comment 6 Ulrich Drepper 2003-11-10 17:39:01 EST
The current glibc in FC1 and in the test version of the RHL errata at


and the test version of the RHL8 errata at


has this fixed.  We'll probably not going to fixed this for 7.2 since
the patch cannot be backported.  Try the errata versions if possible
and let us know.
Comment 7 Mark J. Cox 2003-12-12 04:24:52 EST
Closing as it is fixed in RHL9, FC1, and above.

Note You need to log in before you can comment on or make changes to this bug.