Saturday, November 13, 2010

Postfix records in maillog have time stamps from different time zones

SkyHi @ Saturday, November 13, 2010

Symptoms

If you look at /usr/local/psa/var/log/maillog, you may find your postfix/smtpd time stamp is switched by several hours:

Feb 15 05:24:33 server postfix/smtpd[11984]
Feb 15 14:24:44 server postfix/smtpd[12001]
Feb 15 05:24:44 server postfix/smtpd[11984]
Feb 15 05:24:44 server postfix/smtpd[12001]
Feb 15 14:24:45 server before-remote[12000]

Resolution

It is compounded by the fact that a part of Postfix processes, for security reasons, runs in chrooted environment and /etc/localtime is not accessible for them, so that records are written into maillog with UTC time zone.

To resolve the issue create directory /var/spool/postfix/etc :
# mkdir /var/spool/postfix/etc

and copy file /etc/localtime to that directory:
# cp /etc/localtime /var/spool/postfix/etc/

Then restart mail service.

Additional information

This issue affects only Postfix on RPM-based systems. Script /etc/init.d/postfix on Debian GNU/Linux copies necessary files on start. 
 
REFERENCES
http://kb.parallels.com/8082