log time is different

[Anonymous]

i have just integrated some device in my SA server and when i try to investigate their log i found that capture time is different as local time time i think that UTC time, can anyone please tell me how should i keep it at local time on all the device i tried from appliance task set device buit in clock but then too i am getting same UTC, i also tried from TZ select but then too its no change

i want to put log time as local time

[Anonymous]

even.time field is not always in UTC -- event.time field is parsed by the parser as @EVNTTIME(<data/time format>, data/time fields..).  However, if the log file that came from the device is actually in local time then the event.time field in NWDB (and event_time field on SAW) will have that particular local timestamp.  I do not believe SA normalizes this at all to UTC.

Please correct me if I'm wrong, this has been my impression thus far.

[Anonymous]

Hi Scott,

enVision NIc web server is not starting showing an issue, have any idea how to restart this service so i can access GUI

[Anonymous · Accepted solution]

USE this to set SA time as per local time, in all appliance

ex: i have set Indian Local time

To change the time zone UTC to IST

ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime

To change the time as per local time

date +%T -s "10:13:13"

Sync hardware clock to system clock to make all time set

hwclock --systohc

[Anonymous]

Did this fix the reports and timestamps?

[Anonymous]

yes, it works for me

[Anonymous]

Hi sean,

its fix the time in SA mean when we run a report in SA its showing local time stamp but when we schedule a report and set output action as SMTP then on mail address it showing UTC time, no idea how and why its time is changed on smtp or output action

if anyone know the solution please share

[Anonymous]

HI Scott,

As per RSA Support report time issue is resolved in 10.3.2 means SA will provide a report in both time Zone, UTC as well as Local  but after the upgradation(10.3.1 to 10.3.2) still we are facing same issue, report time stamp is in UTC.

have anyone resolved report time issue?

[Anonymous]

I am still facing the issue also.