# Jounal entry times don't agree with sar

When I run "journalctl | less" and then search for a date ie. Feb 28 the times on the journal entries don't agree with what sar shows. I know the times for the sar entry is correct since that was when I power cycled the machine. Example journal:

Feb 27 18:26:15 cyclops dnf[15817]: DNF version: 0.6.4
Feb 27 18:26:15 cyclops dnf[15817]: Making cache files for all metadata files.
Feb 27 18:26:15 cyclops dnf[15817]: Metadata cache refreshed recently.
-- Reboot --
Feb 28 04:35:50 localhost.localdomain systemd-journal[147]: Runtime journal is u
sing 8.0M (max allowed 794.8M, trying to leave 1.1G free of 7.7G available → cur
rent limit 794.8M).
Feb 28 04:35:50 localhost.localdomain systemd-journal[147]: Runtime journal is u
sing 8.0M (max allowed 794.8M, trying to leave 1.1G free of 7.7G available → cur
rent limit 794.8M).


Example from sar:

\$ sar -u -f /var/log/sa/sa28
Linux 3.18.7-200.fc21.x86_64 (cyclops)  02/28/2015  _x86_64_    (4 CPU)

09:36:22 AM       LINUX RESTART (4 CPU)

09:40:24 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
09:50:04 AM     all      1.17      0.23      0.41      0.61      0.00     97.58


Is this a bug?

edit retag close merge delete

What timezone are you in? It's possible that one use local and the other GMT? Can you check this please? timedatectl should tell you.

( 2015-03-03 05:53:08 -0600 )edit

I think you are correct, it seems as if journalctl or the journal must use GMT and sar uses local time. I'm in EST right now. Another layer of confusion in trying to understand what going on. When I run timedatectl I get the following at the end of the output and am not sure what it means: Warning: The system is configured to read the RTC time in the local time zone. This mode can not be fully supported. It will create various problems with time zone changes and daylight saving time adjustments. The RTC time is never updated, it relies on external facilities to maintain it. If at all possible, use RTC in UTC by calling 'timedatectl set-local-rtc 0'. Now it seems I should run timedatectl set-local-rtc 0 but I'm not really sure how the system got set up this way. I didn't knowingly do ...(more)

( 2015-03-03 08:46:33 -0600 )edit

Still a little confused I found a site that documents jounald ( https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs ) and in it it states that journald defaults to UTC but should use the timezone that is set for the system and according to that timedatectl shows : SU: # timedatectl Local time: Wed 2015-03-04 09:08:44 EST Universal time: Wed 2015-03-04 14:08:44 UTC RTC time: Wed 2015-03-04 09:08:44 Time zone: America/New_York (EST, -0500) NTP enabled: yes NTP synchronized: yes RTC in local TZ: no DST active: no Last DST change: DST ended at Sun 2014-11-02 01:59:59 EDT Sun 2014-11-02 01:00:00 EST Next DST change: DST begins (the clock jumps one hour forward) at Sun 2015-03-08 01:59:59 EST Sun 2015-03-08 03:00:00 EDT The only change I have made is I entered the timedatectl set-local-rtc 0 . So is it possible that ...(more)

( 2015-03-04 08:27:41 -0600 )edit

It records the time in UTC, but displays the time in the user's local timezone. So, journald is always using UTC, and journalctl is always giving you local time - unless you use the --utc option.

( 2015-03-04 14:18:00 -0600 )edit