On Tue, 24 Oct 2006 15:59:16 -0500 (CDT) "Jeremy C. Reed" <[EMAIL PROTECTED]> wrote:
> > Oct 23 08:57:26 adminserver sshd[19422]: Failed password for > > invalid user ... ssh2 > > Oct 23 *04:57:30* adminserver sshd[19423]: Failed password for > > invalid user ... ssh2 > > Oct 23 08:57:30 adminserver sshd[19424]: Failed password for > > invalid user ... ssh2 > > Oct 23 *04:57:34* adminserver sshd[19425]: Failed password for > > invalid user ... ssh2 > > Oct 23 08:57:34 adminserver sshd[19426]: Failed password for > > invalid user ... ssh2 > > From looking at the openssh source for this (auth.c and log.c) I > don't see any timestamp added to the message. Perhaps the timestamp is added by glibc. > When syslogd receives a message without timestamp it adds its own. > > I don't know why your syslogd is logging with different times, but > I'm guessing that something is causing the timezone to change. As I've already suggested, I think it's because the permissions on a timezone file are wrong. Check the permissions on the file /etc/timezone, the directory /etc, and the directories /usr/share/zoneinfo, /usr/share and /usr, for example. -- Robin
