Article Content
Article Number | 000026824 |
Applies To | RSA Product Set: Security Analytics, NetWitness Logs & Network RSA Product/Service Type: Log Collector (WinRM Collection) RSA Version/Condition: 10.x, 11.x Platform: CentOS O/S Version: EL6, EL7 |
Issue | Understanding event time in Windows logs collected via WinRM collection method in RSA Security Analytics / NetWitness Logs & Network. |
Resolution |
The UTC time zone is sometimes denoted by the letter Z - a reference to the equivalent nautical time zone (GMT), which has been denoted by a Z since about 1950. The letter also refers to the "zone description" of zero hours, which has been used since 1920 (see time zone history). Since the NATO phonetic alphabet word for Z is "Zulu", UTC is sometimes known as Zulu time. This is especially true in aviation, where Zulu is the universal standard.[23] This ensures all pilots regardless of location are using the same 24-hour clock, thus avoiding confusion when flying between time zones.
How the Time is determined ? Example <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> <System> <Provider Name='Microsoft-Windows-PrintService' Guid='{747EF6FD-E535-4D16-B510-42C90F6873A1}'/> <EventID>800</EventID> <Version>0</Version> <Level>4</Level> <Task>43</Task> <Opcode>1</Opcode> <Keywords>0x4004000000000000</Keywords> <TimeCreated SystemTime='2014-01-28T14:53:41.154411700Z'/> <EventRecordID>34724172</EventRecordID> <Correlation/> <Execution ProcessID='6432' ThreadID='4992'/> <Channel>Microsoft-Windows-PrintService/Operational</Channel> <Computer>server1.abc.def.ghk</Computer> <Security UserID='S-1-5-21-1605315502-1971273683-2142917321-8548458'/> </System> <UserData> <JobDiag xmlns:auto-ns3='http://schemas.microsoft.com/win/2004/08/events' xmlns='http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events'> <JobId>19</JobId> </JobDiag> </UserData> <RenderingInfo Culture='en-US'> <Message>Spooling job 19.</Message> <Level>Information</Level> <Task>Print job diagnostics</Task> <Opcode>Start</Opcode> <Channel>Operational</Channel> <Provider>Microsoft-Windows-PrintService</Provider> <Keywords> <Keyword>WDI Diag</Keyword> </Keywords> </RenderingInfo> </Event>
|
Legacy Article ID | a64915 |