[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#780239: log timestamps could be off by a whole minute



Package: src:linux
Version: 3.16.7-ckt7-1
Severity: wishlist

Here's a risk I sent to
http://catless.ncl.ac.uk/Risks/28.55.html#subj13
which ought to also be reported here.

One day in a court of law, the log files of a computer system will be
used to prove that some incident happened at some certain time.

Let's have a look.

journalctl says
Mar 10 03:14:32 jidanni2 kernel: sd 2:0:0:0: [sdb] Attached SCSI
Mar 10 03:14:32 jidanni2 kernel: EXT4-fs (sda8): mounted filesys

/var/log/kern.log says
Mar 10 03:14:47 jidanni2 kernel: [    4.000166] sd 2:0:0:0: [sdb
Mar 10 03:14:47 jidanni2 kernel: [   62.534080] EXT4-fs (sda8):

So did this happen at 03:14:32 or 03:14:47 or is all we in fact really
know was that there was an entire (62 - 4 =) 58 second gap between the
two lines?

The latter: my screen froze for a minute.


Reply to: