I have a graylog server that is running fine for years until we have to shut it down and move to a different subnet. my root timezone is in UTC and my server time is in +8. my problem is I cannot see the latest log entry and only shows the log based on the current UTC time.
I am using graylog 2.4.6 running on docker.
my current time is 13:16 Manila time. latest entry in the screenshot is 8 hours behind.
When you made the configuration to graylog.config did you execute a service restart.
My apologies I’m not very good with Docker.
Graylog has a default user called Admin, is this still accessible to you? or was this changed? If it wasn’t change can you logon with "Admin and recheck the timestamp issue? For user admin, it uses timezone defined in /etc/graylog/server/server.conf file, parameter root_timezone.
The reason for this is I’m wondering if only a user created has issues or its global issue.
I have also found this, another community member had a similar issue like your yours
And this I noticed was someone with Docker. Specailly this part
sudo docker-compose down
update your graylog.env with, for example America/New_York
TZ=Etc/GMT+8 <--I added this part for you.
I did some more research and from what I understand is its the GL server/Docker but if you got a chance to read that last post it has another ideas for you to be able to try. One being the type of Time Zone needed. I also found issues on GitHub about the Docker version you have. Sorry I can be more help
EDIT: Can you add your local files (/etc/timezone and /etc/localtime) as volume in your docker-container.
Update your docker-compose.yml with the following lines.
Could you explain Not All but data is till 8 hours late? Kind of confusing but if its not working as expected, I’m not sure.
Did you check the Date/Time inside your Docker container?
Just to clarify, when you see the timezone incorrect from the Graylog Server Time configuration section this would be Graylog is picking up that date/time/zone. Since your using Docker I would assume its from your container date/time.