Date/Time in Log & Report > System Events displays 1969-12-31

[ernest_louie]

Today (3/8/20) … Daylight Savings Time, the FortiGate 91E displays "1969-12-31" for all System Events.  In the System Event log, there is a event that the "Disk log has rolled", which was at midnight.  The first "1969-12-31" display occurred at 01:23 on 3/8/20 and logs have not been displayed since that time.  The event prior to this was a User (pupkin) trying to login as Administrator (ssh from 62.210.77.54), but was recorded as an invalid user name.  Found out that this 62.210.77.54 IP is assigned from The Réseaux IP Européens Network Coordination Centre, which is the regional Internet registry for Europe, West Asia, and the former USSR. It is headquartered in Amsterdam, with a branch office in Dubai.

Any help with this would be greatly appreciated.

[ede_pfau]

This particular date is one day before the start of the UNIX time epoch, 1.1.1970 0:00, at which Linux clocks start to count from 0 upwards. It's so to speak "-1".

Clearly a bug in FortiOS. Not much you can do...

- reboot

- open a support ticket to let FTNT fix it

Might indicate a problem with the mysql database.

The login attempt probably is just coincidental. Looking up that IP here

https://www.ip-adress.com/ip-address/ipv4/62.210.77.54

yields a French ISP's client, 62-210-77-54.rev.poneytelecom.eu.

If it really were RIPE itself, woah...

[ernest_louie]

Hi Ede - Thanks for the response about it potentially being a FortiOS bug.  I will be upgrading my current version to a 6.2.x or above in the near future.  I'm currently running v5.4.7 build 1167.  Thought it might be a quick fix.  Thanks! 

[ernest_louie]

Just checked the System Event logs again and a "Disk log roll request has been sent." messages got displayed at midnight, and subsequently (~40mins), the Date/Time display was resolved and "Messages" were being posted properly.  An FSCK was done the day prior, so the File System Check may have resolved this issue.  Thanks.

[andreasc]

Hi four years later :)
You probably have "scheduled local reports" enabled. Just happened to me and I changed time from 00:00 to 03:00 one a week instead of every midnight.
(/log/reports?tabType=local)
Try to disable/change the schedule.
Br,
andreas

[mstrbj]

I'm having the same issue running version 6.0.8. All of a sudden my 90E stopped passing traffic, the implicit deny block all communcations. No usefull info found issuing diag debug crashlog read. I realized my log stamps were all dated 1969-12-31. Compared a backup configuration with the running config found no issues. Figured I may have run into a bug so I upgraded to 6.0.9 which fixed my traffic issue but my log stamps are still recording 1969-12-31