Apache timezone logging problem

Hi, a few days ago Apache started writing some entries with the wrong timezone to our access_log

It goes like this: there might be 100 entries with the correct GMT-5 timezone, then comes one with the timezone +0200 (and thus 7 hours ahead of the other log entries

This causes our awstats software to flip out because it regards all those records with the correct timezone to be 7 hours too old...

The time on our server has been set to America/Chicago since it was installed, I have been running the clock against three NTP servers but thought that maybe was what was causing the errors but disabling ntpd did not help.

I am running Apache/2.0.46 on Red Hat Enterprise Linux ES v3.0 with all updates applied, I have tried to reboot the server and I have also disabled ntpd from starting automatically on boot, which did not solve the problem. I also created a symbolic link from /usr/share/zoneinfo/America/Chicago to /etc/timezone but that did not help either.

This problem just started by itself, I have not done anything bar keeping up with the updates released by Redhat for my system via up2date so I guess one of those could be the culprit but then again you would think that by now other people would have similar issues but google searches have just turned up hits for timezone problems related to viruses spreading and as you can see from the log below this is a completley normal access attempt...

If you could give any pointers to why this happenes it would be great, here are two entries from our logs, they are consecutive (right after one another) if you substract 7 hours (the timezone difference) from the GMT+2 entry you will notice they are at the same time... The GMT time is always changed to +0200, nothing else. I have added this to my httpd.conf file which did not fix the issue: "setenv TZ America/Chicago"

Note that GMT+2 happenes to be the timezone I am in (Sweden during summertime) so perhaps this could have been a SSH error when I was configuring my server but then again that should have been solved by a reboot IMHO

137.150.XXX.XXX - - [25/Oct/2004:19:25:53 -0500] "GET /images/rightnav_forum.gif HTTP/1.1" 304 - "http://www.techspot.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
200.121.XXX.XXX - - [26/Oct/2004:02:25:53 +0200] "GET /files/336tribaldef.php HTTP/1.1" 200 402 "http://www.techspot.com/files/1-336.php" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
LVL 1
OccupiedAsked:
Who is Participating?
 
ITcrowCommented:
Monitor the log carefully!

You will notice that TZ problem is occuring always after execution of certain perl/php/c code. Narrow it down to the script causing this problem. Your TZ change in the script is cached and affecting server settings.

If you are using PHP carefully monitor putenv(TZ=...)
In perl look for $ENV{TZ}.

If you do need a time change in your scripts, achieve it by pointing to timezone file.
Eg. $ENV{TZ} = "/path/to/America/Chicago";
In place of setting $ENV{TZ} = "America/Chicago";


0
 
wesly_chenCommented:
Hi,

   Could that be the file "/usr/share/zoneinfo/America/Chicago" corrupted?

Wesly
0
 
OccupiedAuthor Commented:
I am not the webmaster of the site but I do not think we have a need for any code like that...

But thanks to your post I just realized that our advertisement php files comes up quite often with GMT+2 entries... So I will have a look at those (we do not keep control of them ourselves, our ad agency does...)

Thanks for the pointer, I will look into this during the weekend and post back what I find...
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
ITcrowCommented:
Sure!

I did some more research on the problem, and it looks like a bug/feature where change
in time-zone is cached for sometime by the language compiler / interpreter or web-server.
0
 
OccupiedAuthor Commented:
ITcrow; the issue was in the file include/validate.php in my webmail software, I run Squirrelmail and have for about two years now... It is a great software...

But stupid me decided after two years to change his timezone setting in the webinterface... So that is why the problem started "out of the blue"

I am running squirrelmail v1.5.1 CVS and on line 105 in include/validate.php this code: putenv("TZ=".$timeZone);
Is what causes the issue, this will most likley not be an issue on a low traffic site because then the caching is not so heavily used as it is on our site (www.techspot.com)

I used "grep -r 'TZ=' *" in my DocumentRoot directory to locate the file, thus searching through every file I have on my website...
0
 
ITcrowCommented:
Awesome!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.