Wrong date and time in IIS log file

Hi

I am having issues with the date and timestamp in my IIS log file.

NO, we are not talking about the timestampe being in GMT - the
timestamp is not just some hours wrong - it is a couple of months off.

The log file is here:
#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2007-11-20 08:06:37
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query
s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus
sc-win32-status
2008-01-06 18:13:18 W3SVC124315502 127.0.0.1 GET
/thy.ax_tms_integration.BlockOrders/thy_ax_tms_integration_B lockOrders_Handle_BlockOrdersResponse_Orchestration_Receive_ TMS_BlockOrdersResponse.asmx
- 8000 - 127.0.0.1
Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+ 1.1.4322;+.NET+CLR+2.0.50727)
200 0 0


As you can see, the log file was created today at 08:06:37 (which was
actually 09:06:37 local time). But the entry in the log file says it
came in on January 6'th 2008. What's up with that?

Any thoughts? Thanks!

--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

On Tue, 20 Nov 2007 10:07:37 +0100, Jan Eliasen
wrote:

>As you can see, the log file was created today at 08:06:37 (which was
>actually 09:06:37 local time). But the entry in the log file says it
>came in on January 6'th 2008. What's up with that?
It turns out, that IIS wirtes the exact same date and timestamp in ALL
lines entered into the log file. Even after an IISRESET.

Any thoughts?

--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

Do you have ISAPI filter that may be changing this?

Cheers
Ken

--
My IIS Blog: www.adOpenStatic.com/cs/blogs/ken

"Jan Eliasen" wrote in message
news:2ac5k3hvvmkc6ah81ik1uj9qv4f0i8sev3@4ax.com...
> On Tue, 20 Nov 2007 10:07:37 +0100, Jan Eliasen
> wrote:
>
>>As you can see, the log file was created today at 08:06:37 (which was
>>actually 09:06:37 local time). But the entry in the log file says it
>>came in on January 6'th 2008. What's up with that?
> It turns out, that IIS wirtes the exact same date and timestamp in ALL
> lines entered into the log file. Even after an IISRESET.
>
> Any thoughts?
>
> --
> eliasen, representing himself and not the company he works for.
>
> Private blog: http://blog.eliasen.dk
>
> Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

On Tue, 20 Nov 2007 21:27:03 +1100, "Ken Schaefer"
wrote:

>Do you have ISAPI filter that may be changing this?
Hi. Thanks for your answer.

No, no ISAPI filters. Any other ideas?

--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

So, EVERY log entry has the same time? Or it's consistently off by a set
amount of time?

Is the server time clock correct?

Is it set to the correct time zone?

Are you looking at the raw log files as they are created? (to avoid third
party apps that might be doing stuff)

Is the server BIOS time correct? (Boot to BIOS and check the clock there.)

Is the motherboard old? (Such that the clock battery is going wierd)

I might try re-applying the Microsoft updates meant to deal with all the
stupid screwd up crap they did with the daylight savings time this year.
Make sure you don't have some crappy third party app trying to "help" you
with that.

"Jan Eliasen" wrote in message
news:2lh5k3d6lq7tgag2kqa67q1ts4q0t4h0pv@4ax.com...
> On Tue, 20 Nov 2007 21:27:03 +1100, "Ken Schaefer"
> wrote:
>
>>Do you have ISAPI filter that may be changing this?
> Hi. Thanks for your answer.
>
> No, no ISAPI filters. Any other ideas?
>
> --
> eliasen, representing himself and not the company he works for.
>
> Private blog: http://blog.eliasen.dk
>
> Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

On Tue, 20 Nov 2007 14:30:49 GMT, ".._.." <.._..@yourmom.mil> wrote:

>So, EVERY log entry has the same time? Or it's consistently off by a set
>amount of time?
EVERY log entry has the same time - 2007-01-06 18:13:18

>Is the server time clock correct?
Yes

>Is it set to the correct time zone?
Yes

>Are you looking at the raw log files as they are created? (to avoid third
>party apps that might be doing stuff)
The raw files in c:\windows\system32\logfiles\therightfolder

>Is the server BIOS time correct? (Boot to BIOS and check the clock there.)
This is a production server. Booting to BIOS is something I would like
to avoid. Besides, it is a virtual machine on VMWare - so should be
ok.

>Is the motherboard old? (Such that the clock battery is going wierd)
No. This is a pretty new and big VMWare environment.

>I might try re-applying the Microsoft updates meant to deal with all the
>stupid screwd up crap they did with the daylight savings time this year.
>Make sure you don't have some crappy third party app trying to "help" you
>with that.
Well, I can try searching for something like that, but the time stamp
is off by 1 month and 15-16 days or something. Doesn't sound like just
one hour of daylight savings change...

Perhaps tomorrow it will use another timestamp and that will give a
clue as to what is wrong.

--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

Hi,

I have seen a similar issue. I had IIS running in VMWare, and the logs
where a few days off. But i don't think it was the same timestamp, i am
not sure however.

In my case, it was a development "machine", so i could restart IIS, and
that fixed it. But that does not seem to solve your problem (you have
tried IISRESET and if my solution would work, this would have fixed the
problem).

Does the event log (and other logs) also give you the same strange date?
Or can we isolate it to IIS logs?

--
Regards,
Kristofer Gafvert
http://www.gafvert.info/iis/ - IIS Related Info


Jan Eliasen wrote:

>On Tue, 20 Nov 2007 14:30:49 GMT, ".._.." <.._..@yourmom.mil> wrote:
>
>>So, EVERY log entry has the same time? Or it's consistently off by a set
>>amount of time?
>EVERY log entry has the same time - 2007-01-06 18:13:18
>
>>Is the server time clock correct?
>Yes
>
>>Is it set to the correct time zone?
>Yes
>
>>Are you looking at the raw log files as they are created? (to avoid third
>>party apps that might be doing stuff)
>The raw files in c:\windows\system32\logfiles\therightfolder
>
>>Is the server BIOS time correct? (Boot to BIOS and check the clock
>>there.)
>This is a production server. Booting to BIOS is something I would like
>to avoid. Besides, it is a virtual machine on VMWare - so should be
>ok.
>
>>Is the motherboard old? (Such that the clock battery is going wierd)
>No. This is a pretty new and big VMWare environment.
>
>>I might try re-applying the Microsoft updates meant to deal with all the
>>stupid screwd up crap they did with the daylight savings time this year.
>>Make sure you don't have some crappy third party app trying to "help" you
>>with that.
>Well, I can try searching for something like that, but the time stamp
>is off by 1 month and 15-16 days or something. Doesn't sound like just
>one hour of daylight savings change...
>
>Perhaps tomorrow it will use another timestamp and that will give a
>clue as to what is wrong.

Re: Wrong date and time in IIS log file

I suspect something is messing up/chaning the date stamp before writing to
the Log. The 3rd line of the LOG that you posted shows the time the Log was
created.

Why don't you copy an image file and try to access the image directly. Find
out the log entry and post it here.

Regards,

Trevor Benedict
MCSD


"Jan Eliasen" wrote in message
news:hq85k3dopso7em9p7792jv5fdndspp9ruo@4ax.com...
> Hi
>
> I am having issues with the date and timestamp in my IIS log file.
>
> NO, we are not talking about the timestampe being in GMT - the
> timestamp is not just some hours wrong - it is a couple of months off.
>
> The log file is here:
> #Software: Microsoft Internet Information Services 6.0
> #Version: 1.0
> #Date: 2007-11-20 08:06:37
> #Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query
> s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus
> sc-win32-status
> 2008-01-06 18:13:18 W3SVC124315502 127.0.0.1 GET
> /thy.ax_tms_integration.BlockOrders/thy_ax_tms_integration_B lockOrders_Handle_BlockOrdersResponse_Orchestration_Receive_ TMS_BlockOrdersResponse.asmx
> - 8000 - 127.0.0.1
> Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+ 1.1.4322;+.NET+CLR+2.0.50727)
> 200 0 0
>
>
> As you can see, the log file was created today at 08:06:37 (which was
> actually 09:06:37 local time). But the entry in the log file says it
> came in on January 6'th 2008. What's up with that?
>
> Any thoughts? Thanks!
>
> --
> eliasen, representing himself and not the company he works for.
>
> Private blog: http://blog.eliasen.dk
>
> Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

Since this timestamp is correct, the timestamp on the Server and what IIS
write is also correct. It's the rest of the log that gets altered. Will wait
for your reply.

Regards,

Trevor Benedict
MCSD


"Trevor Benedict" wrote in message
news:ODJaMA%23KIHA.4272@TK2MSFTNGP05.phx.gbl...
>I suspect something is messing up/chaning the date stamp before writing to
>the Log. The 3rd line of the LOG that you posted shows the time the Log was
>created.
>
> Why don't you copy an image file and try to access the image directly.
> Find out the log entry and post it here.
>
> Regards,
>
> Trevor Benedict
> MCSD

Re: Wrong date and time in IIS log file

Hi Jan,

This appears to be a known issue and frequently found on virtual machine
due to time sync feature. You may need to restart HTTP service on IIS6 to
recover the behavior. Please refer to the content below:

Problem Description
===============
W3SVC logs show incorrect time - stuck on the same time 2007-11-04 04:56:06

REPRO STEPS
============
1. Changed the system time to a future time (e.g. 11th May 2020)
2. Browsed any site - verified the log file created in the new date/time
3. Changed the system time to be correct (today's date and time)
4. Now, browsed any website and saw that the time on the log files is now
stuck on 11th May 2020's time

RESOLUTION
=========
net stop http
net start w3svc

OR

net stop http
net start http
iisreset

You must restart the http service whenever you change the date in the
server.

Verified in the code and confirmed that this is by design and you need to
follow the above steps to make IIS logging the correct time.

I hope the information helps.

Have a great day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Re: Wrong date and time in IIS log file

On Tue, 20 Nov 2007 09:09:01 -0800, "Kristofer Gafvert"
wrote:

>Does the event log (and other logs) also give you the same strange date?
>Or can we isolate it to IIS logs?
Eventlog seems fine. Also, the IIS log contained the correct date for
when it was created, but 20 milliseconds later, IIS needs to write a
line about receiving a post, and then it writes something else.

--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

On Wed, 21 Nov 2007 03:53:33 GMT, wjzhang@online.microsoft.com
("WenJun Zhang[msft]") wrote:

>RESOLUTION
>=========
>net stop http
>net start w3svc
That helped! Thanks. I had tried resetting IIS - but apparently that
wasn't enough :-)


--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

On Tue, 20 Nov 2007 17:44:03 -0800, "Trevor Benedict"
wrote:

>Since this timestamp is correct, the timestamp on the Server and what IIS
>write is also correct. It's the rest of the log that gets altered. Will wait
>for your reply.
Apparently it was a known bug. WenJuns post helped me.

Thanks for your time.

--
eliasen, representing himself and not the company he works for.

Private blog: http://blog.eliasen.dk

Private email: jan@eliasen.dk

Re: Wrong date and time in IIS log file

You are welcome Jan.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.