diff --git a/doc/html/man5/3proxy.cfg.5.html b/doc/html/man5/3proxy.cfg.5.html
index b87e0f4..0170950 100644
--- a/doc/html/man5/3proxy.cfg.5.html
+++ b/doc/html/man5/3proxy.cfg.5.html
@@ -1136,7 +1136,15 @@ groupname. Unix only.</p>
 [<i>&lt;gid&gt;</i>] <br>
 calls chroot(path) and sets gid/uid. Unix only. uid/gid
 supported since 0.9, can be numeric or
-username/groupname</p>
+username/groupname. The time zone and the syslog connection
+are set up before the call.
+Plugins which read their own configuration or load modules
+while running need them inside the chroot: PAM
+(<i>/etc/pam.d</i> and the modules it names, read for every
+authentication), LDAP (<i>ldap.conf</i> and, for ldaps, the
+CA certificates), ODBC (<i>odbc.ini</i>, <i>odbcinst.ini</i>
+and the driver libraries, loaded again whenever the
+connection is reopened).</p>
 
 
 <p style="margin-left:6%; margin-top: 1em"><b>stacksize</b>
diff --git a/man/3proxy.cfg.5 b/man/3proxy.cfg.5
index 0920fe6..15dbc21 100644
--- a/man/3proxy.cfg.5
+++ b/man/3proxy.cfg.5
@@ -1253,7 +1253,12 @@ for all threads.
 .BR chroot
 \fI<path>\fR [\fI<uid>\fR] [\fI<gid>\fR]
 .br
- calls chroot(path) and sets gid/uid. Unix only. uid/gid supported since 0.9, can be numeric or username/groupname
+ calls chroot(path) and sets gid/uid. Unix only. uid/gid supported since 0.9, can be numeric or username/groupname.
+The time zone and the syslog connection are set up before the call.
+Plugins which read their own configuration or load modules while running need them inside the chroot:
+PAM (\fI/etc/pam.d\fR and the modules it names, read for every authentication),
+LDAP (\fIldap.conf\fR and, for ldaps, the CA certificates),
+ODBC (\fIodbc.ini\fR, \fIodbcinst.ini\fR and the driver libraries, loaded again whenever the connection is reopened).
 
 .br
 .BR stacksize
diff --git a/src/conf.c b/src/conf.c
index 7486185..3a54bd6 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -336,7 +336,8 @@ static int h_log(int argc, unsigned char ** argv){
 #ifndef _WIN32
 			conf.logfunc = logsyslog;
 			if(notchanged) return 0;
-			openlog((char *)conf.logtarget+1, LOG_PID, LOG_DAEMON);
+			/* connected now: after a chroot there is no /dev/log to find */
+			openlog((char *)conf.logtarget+1, LOG_PID | LOG_NDELAY, LOG_DAEMON);
 #endif
 		}
 #ifdef WITH_ODBC
@@ -1596,6 +1597,14 @@ static int h_setgid(int argc, unsigned char **argv){
 }
 
 
+/* What the C library reads on first use from files a chroot hides, read
+   while they can still be found: the time zone, without which every time
+   is UTC. Names looked up through the system cannot be helped this way, the
+   hosts file and resolv.conf are read again for lookups to come. */
+static void prechroot(void){
+	tzset();
+}
+
 static int h_chroot(int argc, unsigned char **argv){
 	uid_t uid = 0;
 	gid_t gid = 0;
@@ -1615,6 +1624,8 @@ static int h_chroot(int argc, unsigned char **argv){
         }
 	if(!chrootp){
 		char *p;
+
+		prechroot();
 		if(chroot((char *)argv[1])) {
 			fprintf(stderr, "Unable to chroot %s", argv[1]);
 			return(1);