On Sun, Mar 10, 2013 at 11:29 PM, Geoff Millikan <gmillikan@xxxxxxxxxxxxx> wrote: > The date and time shown in Apache logs comes from the time zone of the server. If the server's time jumps forward an hour > (adjusting for daylight savings time) the time in the Apache log will jump forward too. To the untrained eye, this may appear as an > 1-hour gap in the logs (example below). But there is no gap - Apache properly logged all requests - no log entries were lost! > > For example let us say Apache is busy logging requests and writing the date and time on each log entry. The seconds are ticking by: > 01:59:57, 01:59:58, 01:59:59 and Apache is writing logs in each second. Now Apache goes to write the next log but before it does, > it retrieves the server time. The server reports that the time (which is the next second) as 03:00:00. So Apache without missing a > beat simply writes that time down**. In other words, the "gap" in the log is not because Apache stopped logging, it is because the > hour did not exist. > > It is generally considered best practice to have Apache (and any other software) record things in UTC time to avoid this issue. > Since there may be many humans viewing the log, it is usually the role of the log analyzer GUI program (like www.analog.cx) to shift > the UTC time into the human's local time as needed for the human's viewing pleasure. > > Hope this helps, > > Geoff Millikan > http://www.t1shopper.com/ > > **Story is illustrative only, actual Apache workflow for time handling under the hood probably different. > > ---= Example "gap" in logs =--- > 65.55.213.38 - - [10/Mar/2013:01:59:51 -0800] GET /ssi/t1shopper.js HTTP/1.1 <snip> > 157.55.32.103 - - [10/Mar/2013:01:59:58 -0800] GET /service/dsl/oh/Hancock.shtml HTTP/1.1 <snip> > 74.111.23.38 - - [10/Mar/2013:01:59:59 -0800] GET /tools/port-number/1125 HTTP/1.1 <snip> > 157.55.32.103 - - [10/Mar/2013:03:00:07 -0700] GET /us/ga/White%20County.shtml HTTP/1.1 <snip> > 74.111.23.38 - - [10/Mar/2013:03:00:08 -0700] GET /tools/port-number/1126/ HTTP/1.1 <snip> > > ---= Additional background =--- > http://httpd.apache.org/docs/current/mod/mod_log_config.html > > http://en.wikipedia.org/wiki/Daylight_saving_time > Don't run Apache in a locale with DST if you do not want local DST times in the logs. Use the C locale instead. You haven't mentioned even what version of Apache or OS you are using, so it is hard to suggest concrete advice.. Cheers Tom --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|