Proftpd might be doing a timestamp offset on your system.
Edit your /etc/proftpd.conf file, and add:
TimesGMT off
to the top of the proftpd.conf file. Save, exit, and restart proftpd.
Some reports mention to add the following code into the top section of your proftpd boot script:
export TZ=":/etc/localtime"
eg: /etc/init.d/proftpd or /usr/local/etc/rc.d/proftpd.
Reference:
mine timezone = GMT+0100 Debian 3.1 (Sarge) proFTPD 1.2.10 snippet from my proftpd.conf: ---8<--- LogFormat default "%h %l %u %t \"%r\" %s %b" LogFormat auth "%v [%P] %h %t \"%r\" %s" LogFormat write "%h %l %u %t \"%r\" %s %b" TransferLog /var/log/proftpd/xfer.log ExtendedLog /var/log/proftpd/access.log WRITE,READ write ExtendedLog /var/log/proftpd/auth.log AUTH auth ExtendedLog /var/log/proftpd/paranoid.log ALL default --->8--- Log snippets: access.log: ---8<--- 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:09:48:30 +0000] "RETR /dyna/minimo-mightymo/MightyMiniMo-Kurzanleitung.pdf" 226 1127495 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:10:03:35 +0000] "RETR aufnahmen.mo.backup.zip" 226 1308316 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:10:09:30 +0000] "RETR mo.backup.kunden.bck" 226 6697263 --->8--- timezone is allways = "+0000" auth.log: ---8<--- vaubox [10946] 62.206.128.98 [17/Nov/2005:15:40:10 +0100] "USER reinhold.karing" 331 vaubox [10946] 62.206.128.98 [17/Nov/2005:15:40:10 +0100] "PASS (hidden)" 530 vaubox [10948] 62.206.128.98 [17/Nov/2005:15:40:17 +0100] "USER reinhold.karing" 331 vaubox [10948] 62.206.128.98 [17/Nov/2005:14:40:17 +0000] "PASS (hidden)" 230 vaubox [10950] 62.206.128.98 [17/Nov/2005:15:40:18 +0100] "USER reinhold.karing" 331 vaubox [10950] 62.206.128.98 [17/Nov/2005:14:40:18 +0000] "PASS (hidden)" 230 vaubox [11019] 62.206.128.98 [17/Nov/2005:15:48:30 +0100] "USER reinhold.karing" 331 vaubox [11019] 62.206.128.98 [17/Nov/2005:15:48:30 +0100] "PASS (hidden)" 530 vaubox [11026] 62.206.128.98 [17/Nov/2005:15:48:37 +0100] "USER reinhold.karing" 331 vaubox [11026] 62.206.128.98 [17/Nov/2005:14:48:37 +0000] "PASS (hidden)" 230 vaubox [11028] 62.206.128.98 [17/Nov/2005:15:48:38 +0100] "USER reinhold.karing" 331 vaubox [11028] 62.206.128.98 [17/Nov/2005:14:48:38 +0000] "PASS (hidden)" 230 --->8--- timezone jumps between +0000 +0100 paranoid.log: ---8<--- 62.206.128.98 UNKNOWN ftp [17/Nov/2005:15:48:30 +0100] "USER reinhold.karing" 331 - 62.206.128.98 UNKNOWN ftp [17/Nov/2005:15:48:30 +0100] "PASS (hidden)" 530 - 62.206.128.98 UNKNOWN ftp [17/Nov/2005:15:48:37 +0100] "USER reinhold.karing" 331 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:15:48:37 +0100] "PASS (hidden)" 230 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:14:48:37 +0000] "OPTS utf8 on" 501 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:14:48:37 +0000] "SYST" 215 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:14:48:37 +0000] "SITE help" 214 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:14:48:37 +0000] "PWD" 257 - 62.206.128.98 UNKNOWN ftp [17/Nov/2005:15:48:38 +0100] "USER reinhold.karing" 331 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:15:48:38 +0100] "PASS (hidden)" 230 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:14:48:38 +0000] "OPTS utf8 on" 501 - 62.206.128.98 UNKNOWN reinhold.karing [17/Nov/2005:14:48:38 +0000] "SYST" 215 ---->8---
There is some inconsitenscy in timezone loging. No other log facility on this machine shows this behaviour, so I think my time setup is correct.
claims to have been fixed in 1.3.0rc5, so use 1.3.0 or higher.
Another report of modifying some code in mod_auth.c and recompiling (no followup on this yet)