"CEF:0|Bitdefender|GravityZone|6.35.1-1|35|Product Modules Status|5|BitdefenderGZModule=modules dvchost=xxx BitdefenderGZComputerFQDN=xxxxx dvc=x.x.x.x deviceExternalId=xxxxx BitdefenderGZIsContainerHost=0 BitdefenderGZMalwareModuleStatus=enabled BitdefenderGZBehavioralScanAVCModuleStatus=enabled BitdefenderGZDataLossPreventionModuleStatus=disabled"
The logs are from Bitdefender and they show a time diff of +15 hrs. and there is no timestamp in logs no other source types from same HF show the behavior only bit-defender logs. All the help is appreciated to correct the time.
It was an issue with NTP sync on the servers got it corrected and its fine now.
It was an issue with NTP sync on the servers got it corrected and its fine now.
1. Check the sourcetype props
2. CEF typically comes with a syslog header. You're not showing the header - maybe it's been cut after the time had beed parsed out from it.
It all boils down to verifying:
1) Raw format of the data coming from the source with tcpdump to be sure what's on the wire
2) Settings for the sourcetype - how the timestamp is being parsed/assigned and how the event is modified on ingestion.
Thanks @PickleRick let me check will update.