Syslog-ng and time

Hi,

I'M using syslog-ng and I wonder why the time in log is not always the right one, it changes for 4 hours later...?

Apr 28 15:26:35 OpenWrt kernel: [   61.380968] ath: regdomain 0x807c dynamically updated by user
Apr 28 15:26:35 OpenWrt kernel: [   67.681342] ath10k_pci 0000:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
Apr 28 15:26:35 OpenWrt kernel: [   67.681381] ath10k_pci 0000:01:00.0: msdu-desc: 2500  skid: 32
Apr 28 15:26:35 OpenWrt kernel: [   67.763437] ath10k_pci 0000:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
Apr 28 15:26:35 OpenWrt kernel: [   67.764259] ath10k_pci 0000:01:00.0: wmi print 'free: 84920 iram: 13156 sram: 11224'
Apr 28 15:26:35 OpenWrt kernel: [   68.145841] ath10k_pci 0000:01:00.0: rts threshold -1
Apr 28 15:26:35 OpenWrt kernel: [   68.146502] ath10k_pci 0000:01:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
Apr 28 15:26:35 OpenWrt kernel: [   68.150091] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
Apr 28 15:26:35 OpenWrt kernel: [   68.162185] br-lan: port 2(phy0-ap0) entered blocking state
Apr 28 15:26:35 OpenWrt kernel: [   68.167393] br-lan: port 2(phy0-ap0) entered disabled state
Apr 28 15:26:35 OpenWrt kernel: [   68.172834] device phy0-ap0 entered promiscuous mode
Apr 28 15:26:35 OpenWrt kernel: [   68.179316] device phy0-ap0 left promiscuous mode
Apr 28 15:26:35 OpenWrt kernel: [   68.183499] br-lan: port 2(phy0-ap0) entered disabled state
Apr 28 15:26:35 OpenWrt kernel: [   68.241780] br-lan: port 2(phy0-ap0) entered blocking state
Apr 28 15:26:35 OpenWrt kernel: [   68.241815] br-lan: port 2(phy0-ap0) entered disabled state
Apr 28 15:26:35 OpenWrt kernel: [   68.246454] device phy0-ap0 entered promiscuous mode
Apr 28 15:26:35 OpenWrt kernel: [   68.401266] ath10k_pci 0000:01:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
Apr 28 15:26:35 OpenWrt kernel: [   68.899242] IPv6: ADDRCONF(NETDEV_CHANGE): phy0-ap0: link becomes ready
Apr 28 15:26:35 OpenWrt kernel: [   68.899374] br-lan: port 2(phy0-ap0) entered blocking state
Apr 28 15:26:35 OpenWrt kernel: [   68.904677] br-lan: port 2(phy0-ap0) entered forwarding state
Apr 28 19:26:36 OpenWrt netifd: wg0 (2519): Try again: `ca-mon.prod.surfshark.com:51820'. Trying again in 1.20 seconds...
Apr 28 15:26:38 OpenWrt kernel: [   74.975499] ath10k_pci 0001:01:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
Apr 28 15:26:38 OpenWrt kernel: [   74.975540] ath10k_pci 0001:01:00.0: msdu-desc: 2500  skid: 32
Apr 28 15:26:39 OpenWrt kernel: [   75.059530] ath10k_pci 0001:01:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
Apr 28 15:26:39 OpenWrt kernel: [   75.060396] ath10k_pci 0001:01:00.0: wmi print 'free: 84920 iram: 13156 sram: 11224'
Apr 28 15:26:39 OpenWrt kernel: [   75.476558] ath10k_pci 0001:01:00.0: rts threshold -1
Apr 28 15:26:39 OpenWrt kernel: [   75.476809] ath10k_pci 0001:01:00.0: Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: 4
Apr 28 15:26:39 OpenWrt kernel: [   75.481833] br-lan: port 3(phy1-ap0) entered blocking state
Apr 28 15:26:39 OpenWrt kernel: [   75.491583] br-lan: port 3(phy1-ap0) entered disabled state
Apr 28 19:26:39 OpenWrt hostapd: phy1-ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
Apr 28 19:26:39 OpenWrt hostapd: phy1-ap0: interface state COUNTRY_UPDATE->HT_SCAN
Apr 28 15:26:39 OpenWrt kernel: [   75.497200] device phy1-ap0 entered promiscuous mode
Apr 28 19:26:39 OpenWrt dnsmasq[1]: started, version 2.90 cachesize 10000
Apr 28 19:26:39 OpenWrt dnsmasq[1]: DNS service limited to local subnets
Apr 28 19:26:39 OpenWrt dnsmasq[1]: compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
Apr 28 19:26:39 OpenWrt dnsmasq[1]: UBus support enabled: connected to system bus
Apr 28 19:26:39 OpenWrt dnsmasq-dhcp[1]: DHCP, IP range 192.168.1.100 -- 192.168.1.249, lease time 12h

Is this during the boot up cycle? If so? The time will be incorrect until ntp completes - this happens. Ear the end of the boot process. After that point, it should remain fairly accurate (certainly within a few seconds, usually well better than that).

2 Likes

the time is ok at the beginning and after that, it switches to 4 hours later, the time was ok with system syslog, but not accurate with syslog-ng

if it's exactly 4 hours, that might be a time-zone related thing, where there's disagreement about whether the clock is saved in UTC or in a 4-hour-different time zone

2 Likes

Check the time zone settings.

https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.18/administration-guide/6

my time zone setting is well configured

Hmm, kernel lines are at 15:26:39, but before and after that are user-space log messages at 19:26:39

There are two potential time zone settings. The system one and then syslog-ng. Check both to ensure they are consistent.

1 Like

I will, thanks

it is ok

but in the syslog-ng tuto, we can read that:

If the timezone is not specified, local timezone is used.

Did you verify that there is no time zone set in the syslog-ng configuration?

1 Like

Yep, I do not see anything about it.

What about if you explicitly add the time zone option to the syslog-ng config?

Here is the solution:

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.