All Apps and Add-ons

wrong time in last connected OPSEC LEA

bhanu22
Engager

In the OPSEC LEA LOGGRABBER APP for checkpoint the time shown in "last connected" is incorrect.
I have the Splunk server running in UTC while I access the Splunk Web interface to create the connection from Singapore it shows me the last connected time in SGT but with future time.
That is SGT is UTC + 8 so the last connected shown in SGT should be local time of Singapore but however the last connected shown to me is UTC + 16 i.e. SGT + 8, hence the OPSEC LEA app is showing me last connected time incorrect. I have confirmed Splunk server, Checkpoint CMA, Gateway and provider-1 all are running in UTC.
Can some one please help me in this issue, I have gone through the Splunk configs no where I have configured any custom timezones, its set to use the local server time.

1 Solution

amarsaroj
Explorer

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

View solution in original post

amarsaroj
Explorer

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

amarsaroj
Explorer

Firefox 14.0.1

0 Karma

araitz
Splunk Employee
Splunk Employee

Nice! I filed OPSEC-125 for this issue. What browser were you using?

0 Karma

bhanu22
Engager

thanks it fixed the issue

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...