diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot
index 553ed621..b581baf1 100644
--- a/testcases/files/logs/dovecot
+++ b/testcases/files/logs/dovecot
@@ -1,12 +1,12 @@
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "80.187.101.33" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "80.187.101.33" }
 @400000004c91b044077a9e94 imap-login: Info: Aborted login (auth failed, 1 attempts): user=<martin@waschbuesch.de>, method=CRAM-MD5, rip=80.187.101.33, lip=80.254.129.240, TLS
 
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "176.61.140.224" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "176.61.140.224" }
 @400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=web rhost=176.61.140.224
 # Above example with injected rhost into ruser -- should not match for 1.2.3.4
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "192.0.43.10" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "192.0.43.10" }
 @400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=rhost=1.2.3.4 rhost=192.0.43.10
-# failJSON: { "time": "2010-09-16T07:51:00", "match": true , "host": "176.61.140.225" }
+# failJSON: { "time": "2010-09-16T06:51:00", "match": true , "host": "176.61.140.225" }
 @400000004c91b044077a9e94 dovecot-auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=root rhost=176.61.140.225  user=root
 
 # failJSON: { "time": "2004-12-12T11:19:11", "match": true , "host": "190.210.136.21" }