multiple log records with different timezones?

[Bob Chiodini]

On Mon, 2006-04-03 at 22:51 -0700, Knute Johnson wrote:
> I'm getting some interesting things in my secure log.  sshd appears 
> to be reporting things in two times, local and UTC.  Anybody else 
> notice this and know how to stop it?  FC5.
> 
> Thanks,
> 
> knute...
> 
> Apr  3 08:01:52 homeonthehill sshd[5220]: Invalid user admin from
> 218.27.100.24
> 
> Apr  3 08:01:52 homeonthehill sshd[5220]:
> pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 
> tty=ssh ruser= rhost=218.27.100.24
> 
> Apr  3 08:01:54 homeonthehill sshd[5220]:
> Failed password for invalid user admin from 218.27.100.24 port 34533 
> ssh2
> 
> Apr  3 15:01:54 homeonthehill sshd[5221]: Failed password for invalid 
> user admin from 218.27.100.24 port 34533 ssh2
> 
> Apr  3 15:01:54 homeonthehill sshd[5221]: Received disconnect from 
> 218.27.100.24: 11: Bye Bye
> 
> Apr  3 08:01:59 homeonthehill sshd[5222]: Invalid user admin from 
> 218.27.100.24
> 
> Apr  3 08:01:59 homeonthehill sshd[5222]: pam_unix(sshd:auth):
> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> rhost=218.27.100.24
> 
> Apr  3 08:02:00 homeonthehill sshd[5222]: Failed
> password for invalid user admin from 218.27.100.24 port 35291 ssh2 
> 
> Apr  3 15:02:00 homeonthehill sshd[5223]: Failed password for invalid 
> user admin from 218.27.100.24 port 35291 ssh2
> 
> Apr  3 15:02:01 homeonthehill sshd[5223]: Received disconnect from 
> 218.27.100.24: 11: Bye Bye
> 
> -- 
> Knute Johnson
> Molon Labe...
> 
> 
> 
I am also seeing this in /var/log/secure.  The messages with the UTC
time Tag appear to be duplicates of messages with a local time tag.  The
message with the UTC tag seems to come from the child (pid+1) of the
process that logged the identical message with the local tag.

No clue on a fix.

Bob...