[no subject]

I am all but certain the box has not been rebooted.  "uptime" shows it has
been running for just over 77 days now and /var/log/dmesg hasn't been
updated since October.

Which log(s) would you recommend I look at?

I think I am just going to start using NTP on it...

Thank you.
-Ryan

----- Original Message ----- 
From: "Geoffrey" <esoteric at 3times25.net>
To: "Atlanta Linux Enthusiasts" <ale at ale.org>
Sent: Wednesday, January 12, 2005 1:23 PM
Subject: Re: [ale] Time issue


> Ryan Fish wrote:
> > What could cause the time on a server running RHEL3 ES to change by
> > roughly 3 hours at least two days in a row?
> >
> > - Time zone is set to America/New York (EST) - NTP is not in use -
> > Box has not been rebooted for 77+ days (so HWClock should have
> > nothing to do with it)
> >
> > Any ideas on where to look will be GREATLY appreciated.
>
> Don't know, but I'd start checking out the logs to see when it happened.
>   You should be able to easily identify a 3 hour jump.  From there, you
> could start checking out cron and such.  If it's something that's just
> started happening, I'd be concerned it's been hacked.
>
> Are you sure it's not rebooted?  I'd verify that via the logs as well.
>
> -- 
> Until later, Geoffrey
> _______________________________________________
> Ale mailing list
> Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt;



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00428" href="msg00428.html">[ale] Time issue</a></strong>
<ul><li><em>From:</em> mike at tyderia.net (Mike Murphy)</li></ul></li>
<li><strong><a name="00429" href="msg00429.html">[ale] Time issue</a></strong>
<ul><li><em>From:</em> mike at tyderia.net (Mike Murphy)</li></ul></li>
<li><strong><a name="00430" href="msg00430.html">[ale] Time issue</a></strong>
<ul><li><em>From:</em> esoteric at 3times25.net (Geoffrey)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00423" href="msg00423.html">[ale] Time issue</a></strong>
<ul><li><em>From:</em> FishR at bellsouth.net (Ryan Fish)</li></ul></li>
<li><strong><a name="00424" href="msg00424.html">[ale] Time issue</a></strong>
<ul><li><em>From:</em> esoteric at 3times25.net (Geoffrey)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00426.html">[ale] Time issue</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00428.html">[ale] Time issue</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00424.html">[ale] Time issue</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00428.html">[ale] Time issue</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00427"><strong>Date</strong></a></li>
<li><a href="threads.html#00427"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>