[syslog-ng] syslog-ng 3.0.4 not adjusting for daylight savings time

Balazs Scheidler bazsi at balabit.hu
Sun Apr 4 10:44:49 CEST 2010


On Thu, 2010-03-25 at 08:49 -0500, Patrick A. Green wrote:
> Patrick A. Green wrote:
> > Balazs Scheidler wrote:
> >   
> >> Are you sure syslog-ng's local timezone is properly set? Is syslog-ng
> >> running in a chroot? If it is, is the timezone in the chroot properly
> >> set?
> >>
> >>   
> >>     
> >
> > We are in fact running chroot.  Is there something more than 
> > /etc/localtime that needs to be put in the chroot environment?
> >
> >   
> 
> I was able to recreate this in a lab environment.
> 
> RHEL3.9
> 
> These packages were required to make 3.0.4 run:
> 
> pkgconfig-0.18
> eventlog-0.2.5
> glib-2.18.4
> 

Hi,

We've got an unrelated bug report which is similar to this one. I've
ported that fix to the OSE right now, can you please test if this patch
fixes the issue for you?

commit 76fba26d259036f0b6ffc6aafb5ca24a2d186594
Author: Juhasz Viktor <jviktor at balabit.hu>
Date:   Sun Oct 25 02:15:17 2009 +0100

    [timestamp] solving the daylight saving problem (fixes: #20182)
    
    The problem was that the local services (CRON, dnsmasq) sends BSD timestamp
    which hasn't any zone information and we assumed that there wasn't daylight
    saving, so set the tm.tm_isdst to -1.
    
    The solution is that let's assume that the correct tm_isdst value is what we
    get from the current local time.
    
    If timezone isn't set, use the local one
    and calculate the correct time

diff --git a/src/logmsg.c b/src/logmsg.c
index b0226c5..5855f09 100644
--- a/src/logmsg.c
+++ b/src/logmsg.c
@@ -1047,8 +1047,9 @@ log_msg_parse_date(LogMessage *self, const guchar **data, gint *length, guchar *
           p = (guchar *) strptime((gchar *) date, "%b %e %H:%M:%S", &tm);
           if (!p || (p && *p))
             goto error;
-            
-          tm.tm_isdst = -1;
+
+          /* In case of daylight saving let's assume that the message came under daylight saving also */
+          tm.tm_isdst = nowtm.tm_isdst;
           tm.tm_year = nowtm.tm_year;
           if (tm.tm_mon > nowtm.tm_mon + 1)
             tm.tm_year--;
@@ -1078,12 +1079,16 @@ log_msg_parse_date(LogMessage *self, const guchar **data, gint *length, guchar *
    * (tm.tm_hour - * unnormalized_hour) part fixes up. */
   
   if (self->timestamps[LM_TS_STAMP].zone_offset == -1)
-    self->timestamps[LM_TS_STAMP].zone_offset = assume_timezone;
-   
-  if (self->timestamps[LM_TS_STAMP].zone_offset != -1)
-    self->timestamps[LM_TS_STAMP].time.tv_sec = self->timestamps[LM_TS_STAMP].time.tv_sec + get_local_timezone_ofs(self->timestamps[LM_TS_STAMP].time.tv_sec) - (tm.tm_hour - unnormalized_hour) * 3600 - self->timestamps[LM_TS_STAMP].zone_offset;
-  else
-    self->timestamps[LM_TS_STAMP].zone_offset = get_local_timezone_ofs(self->timestamps[LM_TS_STAMP].time.tv_sec);
+    {
+      self->timestamps[LM_TS_STAMP].zone_offset = assume_timezone;
+    }
+  if (self->timestamps[LM_TS_STAMP].zone_offset == -1)
+    {
+      self->timestamps[LM_TS_STAMP].zone_offset = get_local_timezone_ofs(self->timestamps[LM_TS_STAMP].time.tv_sec);
+    }
+  self->timestamps[LM_TS_STAMP].time.tv_sec = self->timestamps[LM_TS_STAMP].time.tv_sec +
+                                              get_local_timezone_ofs(self->timestamps[LM_TS_STAMP].time.tv_sec) -
+                                              (tm.tm_hour - unnormalized_hour) * 3600 - self->timestamps[LM_TS_STAMP].zone_offset;
 
   *data = src;
   *length = left;



-- 
Bazsi




More information about the syslog-ng mailing list