Review timezone handling

[tcompa]

On a given system, we have a non-UTC locale but httpd logs in UTC:

# timedatectl  | grep Time
                Time zone: Europe/Zurich (CEST, +0200)

# tail -n1 /var/log/httpd/access_log
X.X.X.X - - [29/Jun/2026:09:38:57 +0000] ...

and I observe

# apache-recent
Log file: /var/log/httpd/access_log
Log delta: 2026-06-28 06:42:43 -> 2026-06-29 09:38:57 (1 day, 2:56:14)

Stats for the last 10 minutes:

-- No log found --

Stats for the last 1 hour:

-- No log found --

---

Question: are the timestamp-parsing and the time-window check timezone-aware?

[zonia3000]

I have explicitly removed the timezone to avoid issues while comparing with datetime.now():

timestamp = datetime.strptime(match.group(1), "%d/%b/%Y:%H:%M:%S %z")
return timestamp.replace(tzinfo=None)

Without this, the following error occurs:

    if now - timestamp <= timedelta(minutes=last_n_minutes):
       ~~~~^~~~~~~~~~~
TypeError: can't subtract offset-naive and offset-aware datetimes

I could parse one line of the file and detect the timezone. I preferred to skip the timezone to avoid doing a double check when the log file is empty and the timezone can't be detected, but I was assuming that the log file and the system always had the same timezone, which it doesn't seem to be true.

[tcompa]

I was assuming that the log file and the system always had the same timezone, which it doesn't seem to be true.

Indeed. In this specific case we could likely change the httpd configuration so that we emit logs in the local timezone, but I'd say it's best if this tool can be a bit more robust and infer the timezone e.g. from an explicit check based on a single log line.

[tcompa]

I confirm that with 6e90737 the UTC timezone of https logs is identified correctly.