Red Hat Bugzilla – Bug 8061
sysklogd logging alternate sockets with wrong time
Last modified: 2014-03-16 22:11:49 EDT
I'm running named in a chroot jail, and using the -a argument to syslogd to get it to listen on a socket within the jail. (/jails/named/dev/log) Information does get logged, but it's logged (I think) with GMT, not with the adjusted local time zone that everything else is logged with. Which leads to stuff like this... (note timestamps) Dec 29 16:03:36 hostname -- MARK -- Dec 30 00:07:09 hostname named[30851]: Cleaned cache of 434 RRsets Dec 30 00:07:09 hostname named[30851]: USAGE [...elided...] Dec 30 00:07:09 hostname named[30851]: NSTATS [...elided...] Dec 30 00:07:09 hostname named[30851]: XSTATS [...elided...] Dec 29 16:18:01 hostname -- MARK -- "hostname" is running a custom 2.2.12 kernel with the latest sysklogd package from updates.redhat.com (1.3-3) and named 8.2.2p5. This also happens on two other machines I administer, which use custom 2.2.13 kernels.
Do you have timezone data in your chroot jail?
nope -- copying /etc/localtime into the chroot jail's "/etc" solves the problem
This is similar to bug 18671, should it be up to the application to decide the current time? Why can't syslogd do this (and therefore make fakeing logs a little harder)?