Re: Odd timestampts in /var/log/messages from sshd

On Tue, 24 Oct 2006 15:59:16 -0500 (CDT)
"Jeremy C. Reed" <reed@xxxxxxxxxxxxx> wrote:

Oct 23 08:57:26 adminserver sshd[19422]: Failed password for
invalid user ... ssh2
Oct 23 *04:57:30* adminserver sshd[19423]: Failed password for
invalid user ... ssh2
Oct 23 08:57:30 adminserver sshd[19424]: Failed password for
invalid user ... ssh2
Oct 23 *04:57:34* adminserver sshd[19425]: Failed password for
invalid user ... ssh2
Oct 23 08:57:34 adminserver sshd[19426]: Failed password for
invalid user ... ssh2

From looking at the openssh source for this (auth.c and log.c) I
don't see any timestamp added to the message.

Perhaps the timestamp is added by glibc.

When syslogd receives a message without timestamp it adds its own.

I don't know why your syslogd is logging with different times, but
I'm guessing that something is causing the timezone to change.

As I've already suggested, I think it's because the permissions on a
timezone file are wrong. Check the permissions on the
file /etc/timezone, the directory /etc, and the
directories /usr/share/zoneinfo, /usr/share and /usr, for example.

--
Robin

Relevant Pages