We noticed at least one issue already - time conversion algorithms change and log processing applications require changes. When you report on log records occurred in 2006 and before, and need to perform time conversion using old time zone settings, but new records will require new conversion. Provided that OS is updated with a DST patch, applications which use time conversion functions built in into operating system will continue to work properly - otherwise they will most likely require updates too. For example, Microsoft Windows provides 2 time conversion functions, SystemTimeToTzSpecificLocalTime and TzSpecificLocalTimeToSystemTime, which perform conversion from GMT to local time and vice versa. But second function was introduced only in Windows XP and newer OSes and applications which support systems prior to WXP (e.g. W2K) emulate its behavior. Guess what happens to them? Right, such implementations require updates. We tested DST update from Microsoft, and it looks like Win32 structure, TIME_ZONE_INFORMATION, suffered changes, which broke our custom implementation and forced us to release updates. The same thing will most likely apply to many other applications, running on different OSes. I encourage everybody to test applications prior to DST switch, to avoid further corruptions of archived log data. With best regards, Michael Fimin. -----Original Message----- From: loganalysis-bounces+mfimin=algorithm.aelita.com@private [mailto:loganalysis-bounces+mfimin=algorithm.aelita.com@private] On Behalf Of Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] Sent: Wednesday, January 17, 2007 8:00 PM To: loganalysis@private Subject: [logs] [Fwd: Tripwire Product Update - DST Is Changing] uh.... what's the DST impact on the various logs and what not..... -------- Original Message -------- Subject: Tripwire Product Update - DST Is Changing Date: Wed, 17 Jan 2007 07:42:05 -0800 From: Tripwire Updates <tripwireupdates@private> To: <sbradcpa@private> Daylight Saving Time (DST) is changing beginning in March 2007. As a result, operating systems and some applications including Tripwire's will require a patch to report time correctly. We recommend you upgrade to the most recent version of your product. Versions Affected: Tripwire Enterprise/Server 6.0 on Linux Tripwire Enterprise/Server 5.5 and older on all platforms Tripwire Manager - All versions, however we still recommend you upgrade to the most recent as we have only tested the patch with versions 4.5, 4.6 and 4.7. Click her to find out more http://www.tripwire.com/support/dst Contact Support support@private <mailto:support@private> or 866.897.8776 for information on upgrading. -- Letting your vendors set your risk analysis these days? http://www.threatcode.com If you are a SBSer and you don't subscribe to the SBS Blog... man ... I will hunt you down... http://blogs.technet.com/sbs _______________________________________________ LogAnalysis mailing list LogAnalysis@private http://lists.shmoo.com/mailman/listinfo/loganalysis _______________________________________________ LogAnalysis mailing list LogAnalysis@private http://lists.shmoo.com/mailman/listinfo/loganalysis
This archive was generated by hypermail 2.1.3 : Thu Jan 18 2007 - 15:40:52 PST