Event log entries during the 2am-3am DST gap -- why?
Published Jan 08 2019 01:53 PM 351 Views
First published on TECHNET on Mar 11, 2007

If you use Event Viewer, DST can cause unexpected behavior because Event Viewer changes the displayed time (and possibly the date) for events that have already occurred.

For example, if an event occurred at 6:00 P.M. in standard time, after you move into DST, that event appears as if it had occurred at 7:00 P.M.

Events in the event log are stored in UTC time.  During DST, events will be posted an hour later than they actually occurred prior to the DST switchover time.  See this link (see the text at the bottom) and this KB article.

There will be no gaps since they are no gaps in UTC or GMT time, which is how the Event log stores events.

To confirm this, please choose one or both of the following demonstrations:

  • To view events before 3am on 3/11 since the start of the log  you would need to turn DST off on the PC (to subtract an hour).  Notice that if you are configured this way, all events since the log was started will be off an hour, not just 2:00am to 3:00am.

  • Conversely with DST turned off, all events in the log after 2 am on 3/11 you will be off by an hour).

Version history
Last update:
‎Jan 08 2019 01:53 PM
Updated by: