NetWitness Community

Anonymous · ‎2013-12-05

i have just integrated some device in my SA server and when i try to investigate their log i found that capture time is different as local time time i think that UTC time, can anyone please tell me how should i keep it at local time on all the device i tried from appliance task set device buit in clock but then too i am getting same UTC, i also tried from TZ select but then too its no change

i want to put log time as local time

Anonymous · ‎2014-01-04

USE this to set SA time as per local time, in all appliance

ex: i have set Indian Local time

To change the time zone UTC to IST

ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime

To change the time as per local time

date +%T -s "10:13:13"

Sync hardware clock to system clock to make all time set

hwclock --systohc

View solution in original post

Anonymous · ‎2013-12-05

I currently have a support ticket open for this exact issue. I will update when I get answers if none are given before then.

Anonymous · ‎2013-12-05

thanks, that will be great

RSAAdmin · ‎2013-12-05

All times in SA Core services are UTC, never local. For technical reasons, the "time" meta, which is present in every log session, is the time the log was parsed. If you want the time of the log (if present), that would be captured as event.time, which should also be in UTC.

Local time would be a conversion for the client, not on the server, as the server does not care what time zone you are in. Your local tz and the server tz may not match.

Anonymous · ‎2013-12-06

okay, but what when a customer asked a report for failed logon with exact local time

RSAAdmin · ‎2013-12-06

All queries against a SA Core service must be in UTC. The client that submits the report must either state the time should be in UTC or convert the local time to UTC before submitting the query.

This is exactly what Investigator 9.8 does. It accepts local times and convert to UTC behind the scenes before submitting the query. If the client you are using is not doing the conversion appropriately, then you are correct to submit a bug report with support.

huanzhou1 · ‎2013-12-06

anything to do with your SA Console timezone?

Anonymous · ‎2013-12-09

no i have already set local time from SA server Console but there is no effect on log captured time. still its UTC and different in according local time, and customer is not ready to accept report with this UTC time.

Anonymous · ‎2013-12-19

have you got any solution for log time?

Anonymous · ‎2013-12-20

I have not found anything new out yet, my RSA case has a engineering ticket open. I have noticed that it can cause a major issue in report though. Two nights ago around 10 we had a crysis style event to restart our apache servers, these events happened but we are in an eastern time zone. The information showed up for the incorrect day because the report added 5 hours to it.

@Scott_NextGen

NetWitness Community

log time is different