Event log entries during the 2am-3am DST gap -- why?

  • Article

If you use Event Viewer, DST can cause unexpected behavior because Event Viewer changes the displayed time (and possibly the date) for events that have already occurred.

 

For example, if an event occurred at 6:00 P.M. in standard time, after you move into DST, that event appears as if it had occurred at 7:00 P.M.

Events in the event log are stored in UTC time.  During DST, events will be posted an hour later than they actually occurred prior to the DST switchover time.  See this link (see the text at the bottom) and this KB article. 

There will be no gaps since they are no gaps in UTC or GMT time, which is how the Event log stores events.

 

To confirm this, please choose one or both of the following demonstrations:

  • To view events before 3am on 3/11 since the start of the log you would need to turn DST off on the PC (to subtract an hour). Notice that if you are configured this way, all events since the log was started will be off an hour, not just 2:00am to 3:00am.
  • Conversely with DST turned off, all events in the log after 2 am on 3/11 you will be off by an hour).