First published on TECHNET on Mar 11, 2007
If you use Event Viewer, DST can cause unexpected behavior because Event Viewer changes the displayed time (and possibly the date) for events that have already occurred.
For example, if an event occurred at 6:00 P.M. in standard time, after you move into DST, that event appears as if it had occurred at 7:00 P.M.
Events in the event log are stored in UTC time. During DST, events will be posted an hour later than they actually occurred prior to the DST switchover time. See
this
link (see the text at the bottom) and
this
KB article.
There will be no gaps since they are no gaps in UTC or GMT time, which is how the Event log stores events.
To confirm this, please choose one or both of the following demonstrations:
-
To view events before 3am on 3/11 since the start of the log you would need to turn DST off on the PC (to subtract an hour). Notice that if you are configured this way, all events since the log was started will be off an hour, not just 2:00am to 3:00am.
-
Conversely with DST turned off, all events in the log after 2 am on 3/11 you will be off by an hour).
