# [solved] syslog-ng madness #2 : timestampts are wrong

## toralf

Upgrade to 3.6.2 at a hardened now gives this :

```
Mar 16 15:07:28 t44 dnsmasq-dhcp[7032]: DHCPACK(br0) 192.168.1.143 72:ef:3d:9f:c3:5a trinity

Mar 16 01:41:17 t44 kernel: br0: port 1(tap0) entered disabled state

Mar 16 01:41:24 t44 kernel: EXT4-fs (loop0): recovery complete

Mar 16 01:41:24 t44 kernel: EXT4-fs (loop0): mounted filesystem with ordered data mode. Opts: (null)

Mar 16 15:10:01 t44 CROND[5149]: (root) CMD ([ ! -x /etc/cron.hourly/0anacron ] && { test -x /usr/sbin/run-crons &&

t
```

 Anybody else already experienced wrong timestamps ?Last edited by toralf on Wed May 27, 2015 7:04 pm; edited 1 time in total

----------

## krinn

you have br0 up and down, if some ntp deamon is link to interface you can have timestamp before ntp was run and timestamp after it no?

----------

## toralf

 *krinn wrote:*   

> you have br0 up and down, if some ntp deamon is link to interface you can have timestamp before ntp was run and timestamp after it no?

 Well, I'm pretty sure, that there was no ntp jump. And I experienced such timestamp jumps month ago w/o having any virtual (UML and/or KVM) machine connectetd to my br0.

----------

## krinn

Was just an idea, i remember you were having issues with syslog-ng.

Looks like you won't slept with syslog-ng's dev again tonight  :Smile: 

----------

## toralf

 *krinn wrote:*   

> Was just an idea, i remember you were having issues with syslog-ng.

  - yeah  - a lot of unprintable chars in version 3.4 and 3.6, vanished w/ setting "thread(no)"

----------

## toralf

BTW another cure examplehttps://bpaste.net/show/284b35a4fd6b

Here ate he diffs are just few seconds  - /me wonders if syslog-ng just delays messages ...

----------

## toralf

bug fix is in test now : https://forums.gentoo.org/viewtopic-p-7754438.html#7754438

----------

## haarp

Having the same problem. syslog-ng 3.6.3 fixes it you say? That doesn't seem to be in portage yet.

My temporary fix is this:

```
source src {

        unix-dgram("/dev/log");

        file("/proc/kmsg" program-override("kernel") flags(kernel) keep_timestamp(no));

        internal();

};
```

----------

## toralf

 *haarp wrote:*   

> Having the same problem. syslog-ng 3.6.3 fixes it you say? That doesn't seem to be in portage yet.
> 
> My temporary fix is this:
> 
> ```
> ...

 wget https://github.com/ihrwein/syslog-ng/commit/75dc0c6d4fffeac7a7b0461a6cdc6edd7a62c22c.patch and applied to 3.6.2 works fine

----------

## haarp

 *toralf wrote:*   

>  *haarp wrote:*   Having the same problem. syslog-ng 3.6.3 fixes it you say? That doesn't seem to be in portage yet.
> 
> My temporary fix is this:
> 
> ```
> ...

 

Threw that in /etc/portage/patches. Thanks!

----------

