Timestamps shifted by 8 hours

[Janos Dohanics]

On Tue, 04 Oct 2011 09:38:46 +0100
Matthew Seaman <m.seaman at infracaninophile.co.uk> wrote:

> On 04/10/2011 05:29, Janos Dohanics wrote:
> > I have pfSense-2.0 for gateway/firewall (10.10.10.2).
> > 
> > 10.10.10.2 logs to 10.10.10.252, which runs FreeBSD 7.4-STABLE.
> > 
> > 10.10.10.252 is the ntpd server for this LAN.
> > 
> > On 10.10.10.2:
> > 
> > date                                                                                
> > Tue Oct  4 00:00:42 EDT 2011
> > 
> > On 10.10.10.252:
> > 
> > $date
> > Tue Oct  4 00:00:50 EDT 2011
> > (just after logging out of 10.10.10.2, so they seem to be in sync)
> > 
> > However, timestamps in pfsense.log, residing on 10.10.10.252, are
> > shifted by 8 hours, for example:
> > 
> > $ tail -f /var/log/pfsense.log
> > Oct  4 09:00:01 10.10.10.2 pf: 00:00:00.748775 rule 1/0(match):
> > [...] ^^^^^^^^
> > 
> > I guess I should read some man page...

Thank you for your reply.

> I'd say this is probably the standard thing about the system clock
> running UTC vs running wall-clock time.  But 8 hours is /twice/ the
> difference between EDT and UTC -- which is suspicious.

Actually, it's 9 hours, not 8.

Just looked in /var/log/filter.log residing on 10.10.10.2. Timestamps
are ahead by 9 hours. However, date shows the correct time (correct to
a few seconds).

On the other hand, /var/log/system.log shows correct timestamps.

So, I asked the wrong question. The question I should be asking is: Why
are timestamps wrong in /var/log/filter.log even though date shows the
correct time? However, this question I should ask the pfSense list...

> For dedicated FreeBSD machines I'd recommend running the system clock
> in UTC.  That avoids a lot of pointless conversion between timezones
> when running ntpd (NTP basically works in UTC internally).  So long
> as the file /etc/wall_cmos_clock *doesn't* exist the system clock
> assumes UTC
> -- see adjkerntz(8) for the details of how it all works.  Also check
> the localtime setup with tzsetup(8).
> 
> [...]
> 
> You don't say if your NTP server is a FreeBSD box or not, but the same
> arguments apply to any Unix-oid OS and you should make the same sort
> of checks there too, as well as on your firewall.

It is, but doesn't seem to be relevant to the problem.

Thank you again,

-- 
Janos Dohanics