Bug#343237: Incorrect timestamp generated after daylight savings time ends

[Anthony DeRobertis]

Joachim Breitner wrote:
> Hi,
> 
> thanks for the bugreport. I'm not sure, though, that this can be fixed
> easily, without Timezone difference information in the syslog. Imagine a
> log with only one entry from these two hours - Parse::Syslog would not
> not have a chance to get it right.

Yeah, certainly can't be guaranteed 100% right. I suspect spitting out a
warning in that case would be a good idea. But often (always if you have
--mark-- generation enabled) there will be enough info in the log to
derive the actual unix timestamp.

E.g., with logic along the lines of this pseudocode:

if its a fallback day (set clocks back 1 hour day)
  if its between fallback_hour and fallback_hour - 1
    if a negative time warp > X secs occurs
      then switch to standard time

with "its" referring to the timestamp of the log line being looked at.

Negative time warps can occur, especially with stupid clock setting
programs which don't slew the clock. [Yeah, we have one at work, and
I've been cursing at it...]. I'm not sure if anything else can cause
time warps in syslogs. So I'm not sure what a good number for X is.

> 
> To me, this seems like a broken by design case, but I'm open for
> suggestions.

Unfortunately, its too late to report bugs in Bejamin Franklin :-D And
changing all the world's syslogds could be difficult (and, considering
the systems generating these logs are running redhat 7...)