topic Re: Monitor File shows GMT not local time in Getting Data In

Monitor File shows GMT not local time

hartfoml — Tue, 10 Sep 2013 19:19:48 GMT

I am collecting syslog using syslog-ng. the events collected in the file are showing GMT.

When I setup a file monitor for the events they are indexed in the future.

What is the best way to handle this using the sourcetype=syslog?

Re: Monitor File shows GMT not local time

jtrucks — Tue, 10 Sep 2013 19:32:43 GMT

in your syslog sourcetype stanza in the props.conf, add:

TZ = UTC

If you don't have one in your local/props.conf, they just add:

[syslog]
TZ = UTC

Then restart the indexer.

Re: Monitor File shows GMT not local time

hartfoml — Tue, 10 Sep 2013 19:35:37 GMT

thanks I am in a distributed environment and I cant (am not allowed to) restart the indexers during working hours.

Also wont this change the timestamp for all syslog not just my new one?

Re: Monitor File shows GMT not local time

jtrucks — Tue, 10 Sep 2013 19:56:18 GMT

Yes. If you need it only for a certain source, use your syslog config to break that out to a separate file or directory tree. Then set up a new source to set the TZ on that source only.