Solved

Apache timezone logging problem

Posted on 2004-10-28
1,009 Views
Last Modified: 2008-01-09
Hi, a few days ago Apache started writing some entries with the wrong timezone to our access_log

It goes like this: there might be 100 entries with the correct GMT-5 timezone, then comes one with the timezone +0200 (and thus 7 hours ahead of the other log entries

This causes our awstats software to flip out because it regards all those records with the correct timezone to be 7 hours too old...

The time on our server has been set to America/Chicago since it was installed, I have been running the clock against three NTP servers but thought that maybe was what was causing the errors but disabling ntpd did not help.

I am running Apache/2.0.46 on Red Hat Enterprise Linux ES v3.0 with all updates applied, I have tried to reboot the server and I have also disabled ntpd from starting automatically on boot, which did not solve the problem. I also created a symbolic link from /usr/share/zoneinfo/America/Chicago to /etc/timezone but that did not help either.

This problem just started by itself, I have not done anything bar keeping up with the updates released by Redhat for my system via up2date so I guess one of those could be the culprit but then again you would think that by now other people would have similar issues but google searches have just turned up hits for timezone problems related to viruses spreading and as you can see from the log below this is a completley normal access attempt...

If you could give any pointers to why this happenes it would be great, here are two entries from our logs, they are consecutive (right after one another) if you substract 7 hours (the timezone difference) from the GMT+2 entry you will notice they are at the same time... The GMT time is always changed to +0200, nothing else. I have added this to my httpd.conf file which did not fix the issue: "setenv TZ America/Chicago"

Note that GMT+2 happenes to be the timezone I am in (Sweden during summertime) so perhaps this could have been a SSH error when I was configuring my server but then again that should have been solved by a reboot IMHO

137.150.XXX.XXX - - [25/Oct/2004:19:25:53 -0500] "GET /images/rightnav_forum.gif HTTP/1.1" 304 - "http://www.techspot.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
200.121.XXX.XXX - - [26/Oct/2004:02:25:53 +0200] "GET /files/336tribaldef.php HTTP/1.1" 200 402 "http://www.techspot.com/files/1-336.php" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"
0
Question by:Occupied
    6 Comments
     
    LVL 38

    Expert Comment

    by:wesly_chen
    Hi,

       Could that be the file "/usr/share/zoneinfo/America/Chicago" corrupted?

    Wesly
    0
     
    LVL 5

    Accepted Solution

    by:
    Monitor the log carefully!

    You will notice that TZ problem is occuring always after execution of certain perl/php/c code. Narrow it down to the script causing this problem. Your TZ change in the script is cached and affecting server settings.

    If you are using PHP carefully monitor putenv(TZ=...)
    In perl look for $ENV{TZ}.

    If you do need a time change in your scripts, achieve it by pointing to timezone file.
    Eg. $ENV{TZ} = "/path/to/America/Chicago";
    In place of setting $ENV{TZ} = "America/Chicago";


    0
     
    LVL 1

    Author Comment

    by:Occupied
    I am not the webmaster of the site but I do not think we have a need for any code like that...

    But thanks to your post I just realized that our advertisement php files comes up quite often with GMT+2 entries... So I will have a look at those (we do not keep control of them ourselves, our ad agency does...)

    Thanks for the pointer, I will look into this during the weekend and post back what I find...
    0
     
    LVL 5

    Expert Comment

    by:ITcrow
    Sure!

    I did some more research on the problem, and it looks like a bug/feature where change
    in time-zone is cached for sometime by the language compiler / interpreter or web-server.
    0
     
    LVL 1

    Author Comment

    by:Occupied
    ITcrow; the issue was in the file include/validate.php in my webmail software, I run Squirrelmail and have for about two years now... It is a great software...

    But stupid me decided after two years to change his timezone setting in the webinterface... So that is why the problem started "out of the blue"

    I am running squirrelmail v1.5.1 CVS and on line 105 in include/validate.php this code: putenv("TZ=".$timeZone);
    Is what causes the issue, this will most likley not be an issue on a low traffic site because then the caching is not so heavily used as it is on our site (www.techspot.com)

    I used "grep -r 'TZ=' *" in my DocumentRoot directory to locate the file, thus searching through every file I have on my website...
    0
     
    LVL 5

    Expert Comment

    by:ITcrow
    Awesome!
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone. Privacy Policy Terms of Use

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    If you are running a LAMP infrastructure, this little code snippet is very helpful if you are serving lots of HTML, JavaScript and CSS-related information. The mod_deflate module, which is part of the Apache 2.2 application, provides the DEFLATE…
    In Solr 4.0 it is possible to atomically (or partially) update individual fields in a document. This article will show the operations possible for atomic updating as well as setting up your Solr instance to be able to perform the actions. One major …
    Want to pick and choose which updates you receive? Feel free to check out this quick video on how to manage your email notifications.
    This video discusses moving either the default database or any database to a new volume.

    875 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now