The date and time shown in Apache logs comes from the time zone of the server. If the server's time jumps forward an hour (adjusting for daylight savings time) the time in the Apache log will jump forward too. To the untrained eye, this may appear as an 1-hour gap in the logs (example below). But there is no gap - Apache properly logged all requests - no log entries were lost! For example let us say Apache is busy logging requests and writing the date and time on each log entry. The seconds are ticking by: 01:59:57, 01:59:58, 01:59:59 and Apache is writing logs in each second. Now Apache goes to write the next log but before it does, it retrieves the server time. The server reports that the time (which is the next second) as 03:00:00. So Apache without missing a beat simply writes that time down**. In other words, the "gap" in the log is not because Apache stopped logging, it is because the hour did not exist. It is generally considered best practice to have Apache (and any other software) record things in UTC time to avoid this issue. Since there may be many humans viewing the log, it is usually the role of the log analyzer GUI program (like www.analog.cx) to shift the UTC time into the human's local time as needed for the human's viewing pleasure. Hope this helps, Geoff Millikan http://www.t1shopper.com/ **Story is illustrative only, actual Apache workflow for time handling under the hood probably different. ---= Example "gap" in logs =--- 65.55.213.38 - - [10/Mar/2013:01:59:51 -0800] GET /ssi/t1shopper.js HTTP/1.1 <snip> 157.55.32.103 - - [10/Mar/2013:01:59:58 -0800] GET /service/dsl/oh/Hancock.shtml HTTP/1.1 <snip> 74.111.23.38 - - [10/Mar/2013:01:59:59 -0800] GET /tools/port-number/1125 HTTP/1.1 <snip> 157.55.32.103 - - [10/Mar/2013:03:00:07 -0700] GET /us/ga/White%20County.shtml HTTP/1.1 <snip> 74.111.23.38 - - [10/Mar/2013:03:00:08 -0700] GET /tools/port-number/1126/ HTTP/1.1 <snip> ---= Additional background =--- http://httpd.apache.org/docs/current/mod/mod_log_config.html http://en.wikipedia.org/wiki/Daylight_saving_time --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|