I'm dealing with daylight saving time and found something interesting.

Assuming that the time is now 2:00 p.m., daylight saving time will start at 3:00 p.m., with an offset of +1 hour.

After 3:00 p.m., hwlock will show the time info which is added by 1 hour.

My guess is that some program must have called hwclock and changed the time info.

How do I know which program did it? Does Linux shell support some commands that show the call log history?


# log hwclock
# program_xxx invoke it at p.m. 3:00
  • 2
    Times are almost always recorded in Unix/Linux as seconds since 01-Jan-1970 (UTC). Whenever a time value is formatted by output, it is converted to text in the local timezone, which is part of the environment. hwclock is not changed, only the presentation of the value. Commented May 11, 2021 at 7:34

1 Answer 1


Normally, the output of the hwclock command is in the local timezone... and the timezone definition includes daylight saving time transitions.

The internal clock of the Linux kernel (as with most unix-like systems) always runs internally in UTC time: whenever a local time is needed, the timezone definition is used to convert the internal UTC representation to the local time. When a DST transition occurs, this means the "local time" appears to jump forward or backward as appropriate. At the same time, the timezone offset reported along with the local time value also changes: usually a DST prefix is added or removed, or if the timezone is expressed as +/- offset to UTC time, that offset value will also automatically change at DST transition.

If you had requested hwclock to show its output in UTC timezone (i.e. TZ=UTC hwclock) then you would have seen the time tick forward as usual, with nothing special happening at the time of DST transition.

So the real explanation is: no special command was executed, instead an old UTC offset value specified in /etc/localtime expired and a new offset defined for a new period of time took effect. You can see all the past and future DST transition times with zdump -v /etc/localtime if you wish. If there are other non-DST changes in the timekeeping in the history of your local timezone, those should be covered too.

But to your actual question, the only reliable way to find out who ran a particular command would be the audit subsystem (auditd and the related tools), which will produce logs in /var/log/audit when configured to do so (or to a custom directory if desired). But it will only log things from the point it has been started: it won't help with events in the past if it is not already configured with suitable logging.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .