wrong time in last connected OPSEC LEA

[bhanu22]

In the OPSEC LEA LOGGRABBER APP for checkpoint the time shown in "last connected" is incorrect.
I have the Splunk server running in UTC while I access the Splunk Web interface to create the connection from Singapore it shows me the last connected time in SGT but with future time.
That is SGT is UTC + 8 so the last connected shown in SGT should be local time of Singapore but however the last connected shown to me is UTC + 16 i.e. SGT + 8, hence the OPSEC LEA app is showing me last connected time incorrect. I have confirmed Splunk server, Checkpoint CMA, Gateway and provider-1 all are running in UTC.
Can some one please help me in this issue, I have gone through the Splunk configs no where I have configured any custom timezones, its set to use the local server time.

[amarsaroj · Accepted solution]

Checkpoint App Version: 1.11.1

This issue is seen when the server where the checkpoint app is setup (usually forwarder) and the user location viewing the 'Manage Connections' fall in different timezone.

Looks like the ajax script controlling the opsec app, is calculating the Date() incorrectly. The Date function which operates on 'data.last_time' (which is epoch time of last connection time) is using the offset parameter unnecessarily. Removing the offset solved the issue.

AJAX file location: $app path/appserver/static/opsec.js';
function: getConnInfo()

EDIT:
d = new Date(data.last_time*1000 - offset);

TO:
d = new Date(data.last_time*1000);

Note: Removal of the browser cache maybe required for the changes to take effect.

[amarsaroj]

Firefox 14.0.1

[araitz]

Nice! I filed OPSEC-125 for this issue. What browser were you using?

[bhanu22]

thanks it fixed the issue