httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Geoff Millikan" <>
Subject [users@httpd] Apache time zone > daylight saving time > missing an hour of logs?
Date Sun, 10 Mar 2013 23:29:45 GMT
The date and time shown in Apache logs comes from the time zone of the server.  If the server's
time jumps forward an hour
(adjusting for daylight savings time) the time in the Apache log will jump forward too.  To
the untrained eye, this may appear as an
1-hour gap in the logs (example below).  But there is no gap - Apache properly logged all
requests - no log entries were lost!

For example let us say Apache is busy logging requests and writing the date and time on each
log entry.  The seconds are ticking by:
01:59:57, 01:59:58, 01:59:59 and Apache is writing logs in each second.  Now Apache goes to
write the next log but before it does,
it retrieves the server time.  The server reports that the time (which is the next second)
as 03:00:00.  So Apache without missing a
beat simply writes that time down**.   In other words, the "gap" in the log is not because
Apache stopped logging, it is because the
hour did not exist.  

It is generally considered best practice to have Apache (and any other software) record things
in UTC time to avoid this issue.
Since there may be many humans viewing the log, it is usually the role of the log analyzer
GUI program (like to shift
the UTC time into the human's local time as needed for the human's viewing pleasure.

Hope this helps,

Geoff Millikan

**Story is illustrative only, actual Apache workflow for time handling under the hood probably

---= Example "gap" in logs =---	-	-	[10/Mar/2013:01:59:51 -0800]	GET /ssi/t1shopper.js HTTP/1.1 <snip>	-	-	[10/Mar/2013:01:59:58 -0800]	GET /service/dsl/oh/Hancock.shtml HTTP/1.1
<snip>	-	-	[10/Mar/2013:01:59:59 -0800]	GET /tools/port-number/1125 HTTP/1.1 <snip>	-	-	[10/Mar/2013:03:00:07 -0700]	GET /us/ga/White%20County.shtml HTTP/1.1 <snip>	-	-	[10/Mar/2013:03:00:08 -0700]	GET /tools/port-number/1126/ HTTP/1.1 <snip>

---= Additional background  =---

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message