Bug 738364 - rsyslog writes bad timestamps for some ssh log messages (timezone problem?)
Summary: rsyslog writes bad timestamps for some ssh log messages (timezone problem?)
Keywords:
Status: CLOSED DUPLICATE of bug 712151
Alias: None
Product: Fedora
Classification: Fedora
Component: rsyslog
Version: 15
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Tomas Heinrich
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-14 15:42 UTC by Peter Backes
Modified: 2016-09-20 04:50 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-28 13:55:50 UTC


Attachments (Terms of Use)

Description Peter Backes 2011-09-14 15:42:00 UTC
Description of problem:
some of the log messages generated by the ssh server seem to have timestamps with incorrect timezone.

Version-Release number of selected component (if applicable):
rsyslog-5.8.2-1.fc15.i686
openssh-5.6p1-34.fc15.1.i686

How reproducible:
always

Steps to Reproduce:
1. start openssh server
2. wait for failed login attempts
3. tail /var/log/secure
  
Actual results:
...
Sep 14 17:29:25 helen sshd[9854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.140.165.85  user=root
Sep 14 17:29:27 helen sshd[9854]: Failed password for root from 219.140.165.85 port 56082 ssh2
Sep 14 15:29:27 helen sshd[9855]: Received disconnect from 219.140.165.85: 11: Bye Bye
        ^--------------- Here

Expected results:
...
Sep 14 17:29:25 helen sshd[9854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=219.140.165.85  user=root
Sep 14 17:29:27 helen sshd[9854]: Failed password for root from 219.140.165.85 port 56082 ssh2
Sep 14 17:29:27 helen sshd[9855]: Received disconnect from 219.140.165.85: 11: Bye Bye

Additional info:

Comment 1 Paul DeStefano 2011-10-08 17:49:43 UTC
I'm seeing this too, only more extreme.  I'm in PDT, which is -7 hours.  The correct time is 9:40AM but the time written looks like UTC.

Oct  8 09:40:18 wrangler sshd[19920]: Invalid user william from 211.138.126.129
Oct  8 16:40:18 wrangler sshd[19921]: input_userauth_request: invalid user william

Could this be a regression of Bug 435472 ?  That appears to be the identical bug.  But, it appears to have been pretty thoroughly discussed, and a code change was made and released.

Comment 2 Tomas Heinrich 2012-02-28 13:55:50 UTC

*** This bug has been marked as a duplicate of bug 712151 ***


Note You need to log in before you can comment on or make changes to this bug.