i have just integrated some device in my SA server and when i try to investigate their log i found that capture time is different as local time time i think that UTC time, can anyone please tell me how should i keep it at local time on all the device i tried from appliance task set device buit in clock but then too i am getting same UTC, i also tried from TZ select but then too its no change
i want to put log time as local time
I currently have a support ticket open for this exact issue. I will update when I get answers if none are given before then.
thanks, that will be great
have you got any solution for log time?
I have not found anything new out yet, my RSA case has a engineering ticket open. I have noticed that it can cause a major issue in report though. Two nights ago around 10 we had a crysis style event to restart our apache servers, these events happened but we are in an eastern time zone. The information showed up for the incorrect day because the report added 5 hours to it.
@Scott_NextGen
even.time field is not always in UTC -- event.time field is parsed by the parser as @EVNTTIME(<data/time format>, data/time fields..). However, if the log file that came from the device is actually in local time then the event.time field in NWDB (and event_time field on SAW) will have that particular local timestamp. I do not believe SA normalizes this at all to UTC.
Please correct me if I'm wrong, this has been my impression thus far.
USE this to set SA time as per local time, in all appliance
ex: i have set Indian Local time
To change the time zone UTC to IST
ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime
To change the time as per local time
date +%T -s "10:13:13"
Sync hardware clock to system clock to make all time set
hwclock --systohc
Did this fix the reports and timestamps?
yes, it works for me
Hi sean,
its fix the time in SA mean when we run a report in SA its showing local time stamp but when we schedule a report and set output action as SMTP then on mail address it showing UTC time, no idea how and why its time is changed on smtp or output action
if anyone know the solution please share huan zhouAdam RasnickRSA Link TeamNaveen Jain
All times in SA Core services are UTC, never local. For technical reasons, the "time" meta, which is present in every log session, is the time the log was parsed. If you want the time of the log (if present), that would be captured as event.time, which should also be in UTC.
Local time would be a conversion for the client, not on the server, as the server does not care what time zone you are in. Your local tz and the server tz may not match.
okay, but what when a customer asked a report for failed logon with exact local time
All queries against a SA Core service must be in UTC. The client that submits the report must either state the time should be in UTC or convert the local time to UTC before submitting the query.
This is exactly what Investigator 9.8 does. It accepts local times and convert to UTC behind the scenes before submitting the query. If the client you are using is not doing the conversion appropriately, then you are correct to submit a bug report with support.
Hi Scott,
enVision NIc web server is not starting showing an issue, have any idea how to restart this service so i can access GUI
HI Scott,
As per RSA Support report time issue is resolved in 10.3.2 means SA will provide a report in both time Zone, UTC as well as Local but after the upgradation(10.3.1 to 10.3.2) still we are facing same issue, report time stamp is in UTC.
have anyone resolved report time issue?
I am still facing the issue also.
anything to do with your SA Console timezone?
no i have already set local time from SA server Console but there is no effect on log captured time. still its UTC and different in according local time, and customer is not ready to accept report with this UTC time.
USE this to set SA time as per local time, in all appliance
ex: i have set Indian Local time
To change the time zone UTC to IST
ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime
To change the time as per local time
date +%T -s "10:13:13"
Sync hardware clock to system clock to make all time set
hwclock --systohc