mod-security-users

[mod-security-users] UTC Logging in Apache

[Tyler <sp...@ty...>]

Hello All,

I just installed mod_security on Apache 1.3.27, and noticed that since I =
did that, Apache is now logging in UTC.  Is this the default action, or =
did I do something wrong? =20

How do I fix this?

Tyler

Re: [mod-security-users] UTC Logging in Apache

[Ivan R. <iv...@we...>]

Tyler wrote:
> Hello All,
>  
> I just installed mod_security on Apache 1.3.27, and noticed that since I 
> did that, Apache is now logging in UTC.  Is this the default action, or 
> did I do something wrong?

   You mean logging outside mod_security, e.g. access_log, error_log etc?

   As far as I am aware mod_security does not and (mostly) cannot
   affect the work of other modules. Can it be something else?

   Does it go away when you comment out the module?

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

Re: [mod-security-users] UTC Logging in Apache

[Tyler <ty...@ty...>]

Yeah, all my Apache logs, access/error and per vhost logs are logging UTC
time.  And yes, it does go away when I comment out the mod_security module.

I'm running Gentoo Linux.

Tyler

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
To: "Tyler" <sp...@ty...>
Cc: <mod...@li...>
Sent: Friday, July 18, 2003 2:39 AM
Subject: Re: [mod-security-users] UTC Logging in Apache


> Tyler wrote:
> > Hello All,
> >
> > I just installed mod_security on Apache 1.3.27, and noticed that since I
> > did that, Apache is now logging in UTC.  Is this the default action, or
> > did I do something wrong?
>
>    You mean logging outside mod_security, e.g. access_log, error_log etc?
>
>    As far as I am aware mod_security does not and (mostly) cannot
>    affect the work of other modules. Can it be something else?
>
>    Does it go away when you comment out the module?
>
> -- 
> ModSecurity (http://www.modsecurity.org)
> [ Open source IDS for Web applications ]
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
> same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>

Re: [mod-security-users] UTC Logging in Apache

[Ivan R. <iv...@we...>]

Tyler wrote:
> Yeah, all my Apache logs, access/error and per vhost logs are logging UTC
> time.  And yes, it does go away when I comment out the mod_security module.

   I've just examined the whole module and I don't have a clue. Send
   me examples of how times are logged with and without mod_security
   so that I can see the difference and I'll keep looking (obviosly,
   this is not happening on any of my installations otherwise it
   would be much easier to track it down).

-- 
ModSecurity (http://www.modsecurity.org)
[ Open source IDS for Web applications ]

Re: [mod-security-users] UTC Logging in Apache

[Tyler <ty...@ty...>]

Ahh..  I think i found the problem, and the solution.  The main reason I
wanted to use mod_security was for its easy chroot feature, and that seems
to be the feature that's doing it.

Mod_security was enabled, but without the secChroot feature enabled.

I've pasted the error_log below.  Basically I restarted Apache, then I Added
the SecChroot line, and restarted again.  You can see the time difference in
the log.

Currently its 2:20 PM Mountain time, 8:20 PM UTC.

(~)# tail /var/log/apache/error_log
[Fri Jul 18 14:17:44 2003] [warn] child process 14990 still did not exit,
sending a SIGTERM
[Fri Jul 18 14:17:48 2003] [notice] caught SIGTERM, shutting down
[Fri Jul 18 14:18:12 2003] [notice] Apache/1.3.27 (Unix)  (Gentoo/Linux)
mod_ssl/2.8.14 OpenSSL/0.9.6i mod_perl/1.27 PHP/4.3.2 configured -- resuming
normal operations
[Fri Jul 18 14:18:12 2003] [notice] suEXEC mechanism enabled (wrapper:
/usr/sbin/suexec)
[Fri Jul 18 14:18:12 2003] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Fri Jul 18 14:19:09 2003] [notice] caught SIGTERM, shutting down
[Fri Jul 18 20:19:17 2003] [notice] mod_security: performed chroot,
path=/www
[Fri Jul 18 20:19:17 2003] [notice] Apache/1.3.27 (Unix)  (Gentoo/Linux)
mod_ssl/2.8.14 OpenSSL/0.9.6i mod_perl/1.27 PHP/4.3.2 configured -- resuming
normal operations
[Fri Jul 18 20:19:17 2003] [notice] suEXEC mechanism enabled (wrapper:
/usr/sbin/suexec)
[Fri Jul 18 20:19:17 2003] [notice] Accept mutex: sysvsem (Default: sysvsem)


So I figured it was because Apache can't see the /etc/localtime file to know
what timezone I was in.  My chroot directory was set to /www  so I created
/www/etc/localtime and it logs in MDT now.

Don't know why I just figured this out now, but it makes sense.

Thank you for all your help.

Tyler

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
To: "Tyler" <ty...@ty...>
Cc: <mod...@li...>
Sent: Friday, July 18, 2003 2:14 PM
Subject: Re: [mod-security-users] UTC Logging in Apache


> Tyler wrote:
> > Yeah, all my Apache logs, access/error and per vhost logs are logging
UTC
> > time.  And yes, it does go away when I comment out the mod_security
module.
>
>    I've just examined the whole module and I don't have a clue. Send
>    me examples of how times are logged with and without mod_security
>    so that I can see the difference and I'll keep looking (obviosly,
>    this is not happening on any of my installations otherwise it
>    would be much easier to track it down).
>
> -- 
> ModSecurity (http://www.modsecurity.org)
> [ Open source IDS for Web applications ]
>
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: VM Ware
> With VMware you can run multiple operating systems on a single machine.
> WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
> same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>