Linux redhat date changed by itself is there a log of date changes? 1

[krusely]

I am a very very low level user of Linux
# uname -a
Linux ecspro 2.6.9-67.ELsmp #1 SMP Wed Nov 7 13:58:04 EST 2007 i686 i686 i386 GNU/Linux

I have a customer that claims his server time changed by itself (advanced about a day and a half in the future). The only time I've seen the date change on a server is if the "watch battery" inside the server starts to go bad but it normally only loses minutes, doesnt change completely. The box is pretty new (6 months old). I ran the "date" command to get the box to the correct date but I was wondering if there is a log of when/who changes the date so I can tell if it was another user or if the system did indeed change on its own. Any help would be appreciated.

 

[Annihilannic]

Have a read of man hwclock, it will allow you to check whether the OS clock has drifted from the hardware clock or not.

I don't think there's a log you can check for that, although it might be worth looking in root's shell history (probably /root/.sh_history) or the sudo logs to see if anyone used the date command to set it.

Is NTP configured on this server? It should keep the time synched with some reliable time source.

Annihilannic.

 

[pentode]

You might check syslog. It seems to show the NTP updates - I don't know about other time changes. I think dmesg shows the time set on boot up.

 

[m4ilm4n]

If you're not running ntp, you can alternately add a cron entry like this:

0 0 * * * /usr/bin/rdate -s clock.server && /sbin/hwclock -w

where clock.server is the hostname of your favorite time provider (I use clock.psu.edu).

this will set both system and hardware clocks at midnight.