[1.6.4] mktime isdst (ubuntu)

[rue]

Hi all,

we noticed a strange behaviour of time-parsing in log-items:

log["/var/log/messages",heartbeat]

Data for this item in GUI and in database looked basically like this:

+----------------------+------------+--------------------------+------------+--------------------------------------------------+
| from_unixtime(clock) | clock      | from_unixtime(timestamp) | timestamp  | value                                            |
+----------------------+------------+--------------------------+------------+--------------------------------------------------+
| 2009-04-07 12:31:25  | 1239100285 | 2009-04-07 13:31:23      | 1239103883 | 2009-04-07T12:31:23+02:00 host01 rue: heartbeat | 
| 2009-04-07 12:30:54  | 1239100254 | 2009-04-07 12:30:53      | 1239100253 | 2009-04-07T12:30:53+02:00 host rue: heartbeat | 
| 2009-04-07 12:30:24  | 1239100224 | 2009-04-07 13:30:23      | 1239103823 | 2009-04-07T12:30:23+02:00 host01 rue: heartbeat | 
| 2009-04-07 12:29:54  | 1239100194 | 2009-04-07 13:29:52      | 1239103792 | 2009-04-07T12:29:52+02:00 host01 rue: heartbeat | 
| 2009-04-07 12:29:24  | 1239100164 | 2009-04-07 12:29:22      | 1239100162 | 2009-04-07T12:29:22+02:00 host01 rue: heartbeat | 
| 2009-04-07 12:28:54  | 1239100134 | 2009-04-07 12:28:52      | 1239100132 | 2009-04-07T12:28:52+02:00 host01 rue: heartbeat | 
...

"clock" values were right on time and correct, while timestamp values (parsed from syslog-messages) were of by one hour every now and then... .

Looking into the code we got to function calc_timestamp in trapper.c, where a struct tm tm is used to gather parsed values from the log-line, that will be converted to a time_t t using function mktime(&tm) a bit later.

Since the struct is never initialized, its tm.tm_isdst seems to be randomly filled with values, leading to the observed behaviour... .

Trivial mktime.patch fixes this issue (tested on ubuntu 8.10, should also work under solaris, according to manual page...).

cheers

Rü