Question
pfsense 2.6.0 Time‑Zone Setting: Resolving Log Timestamp Ambiguity During DST Transitions
Rey Moss
0 reputation · 28 Jun 2025, 19:46 UTC
49.6K views
Loading…
0 reputation · 28 Jun 2025, 19:46 UTC
In pfSense 2.6.0 the global time‑zone setting under System > General Setup drives the OS clock and all local timestamps in the web interface and syslog. The NTP client synchronizes the clock, but the zone is applied only after boot; during an NTP adjustment logs may temporarily show UTC‑like timestamps until the zone is reloaded.
When logs are forwarded to an external syslog server, pfSense transmits RFC 5424 timestamps with a local zone offset. RFC 5424 does not enforce a strict offset field, which can lead to ambiguity during daylight‑saving transitions. Documentation states that pfSense does not automatically adjust log timestamps for DST changes, and administrators must manually verify offsets when reviewing older logs.
There is no official patch or documented feature request addressing potential misalignment of log timestamps during DST changes, leaving this behavior unresolved.
28775 reputation · 29 Jun 2025, 02:22 UTC
In pfSense 2.6.0 the NTP client synchronizes the system clock, but the configured time‑zone is applied only at boot and is not reapplied after each NTP update. Log entries are written with the timestamp supplied by the OS clock; the GUI displays them according to the time‑zone set under System → General Setup, but no DST flag is stored. When logs are forwarded via RFC 5424, the offset reflects the current local offset at the moment the log is generated. During a DST fallback the same local hour occurs twice with the same offset, producing ambiguous timestamps on the receiving syslog server.
pfsenseclog /var/log/system.log | tail -20 and confirm the uniform offset.If you must retain local‑time display, ensure that any external syslog server or correlation tool is configured to interpret the offset correctly and that you accept the possible duplicate‑hour ambiguity during DST fallback. No further pfSense‑side workaround exists without enabling the UTC log option.
Use comments to ask for clarification. Post a solution as an answer.
28,775 reputation · 29 Jun 2025, 07:22 UTC
While switching to UTC via System > Advanced > Miscellaneous resolves the DST offset ambiguity, it is important to note that log monotonicity still depends on the stability of the NTP synchronization. If the NTP client corrects a significant clock drift—rather than performing a gradual slew—you may still see jumps or gaps in the timestamps of forwarded logs.
To verify that your logs are remaining consistent across transitions, you can run the following commands via the pfSense shell to compare the local system time against the universal coordinate:
date
date -uIf you observe unexpected jumps in /var/log/system.log despite using UTC, check the NTP status to ensure the system is not frequently re-syncing due to an unstable upstream source, as this can introduce timing anomalies that UTC alone cannot fix.