We recently upgraded (as in, backup, reinstall, selective restore) a couple of servers from CentOS-3.9 to CentOS-5.1. This generally went smoothly but we've encountered one confusing problem with syslog.
Under CentOS-3, syslog entries were always dated in the host local timezone. With CentOS-5.1, they're dated in UTC *most* of the time, but occasionally in the local timezone. This has seriously confused a couple of our homegrown process monitoring scripts.
The cron, secure, and maillog logs are all consistently in the local timezone ... it's only /var/log/messages that wanders around.
It appears that any given process is consistent about which timezone it uses, but there's no obvious reason why any particular process gets the local zone vs. UTC. For example, we have a couple of long-running daemons that fork children to handle network requests, and although the parent daemon consistently logs in one timezone, its forks (which do not even do an exec, so they should be identical to the parent) randomly switch to the other timezone.
What we'd like is for the local timezone always to be used as it was before. What configuration option or whatever, have we missed?