Messages 2 hours behind

[servicedesk (Olivier)]

Hi

We are using Graylog 3.2.4 and in the GUI messages are shown 2 hours later

1 TCP input is created and messages are coming in coming from our firewall on port 5514

the system times show all 3 correctly in the GUI and also the firewall uses the same time.

what can we do to have real time messaging ? doesn’t have to be the same second but would be nice to see it much quicker.

one of the fields in the message shows:
tz
+0200

so it looks like it has time zone information. We are using UTC + 2 so looks correct. ( Amsterdam )

the timestamp in one of the messages itself looks like this:

timestamp

2020-08-28 16:37:01 +02:00

thanks for your information. Is is a nice puzzle to solve anyway . We very much like the graylog application so I think this is easy to correct. If it needs a pipeline can you provide us with an example ? Not sure if this is the case.

greetings

[ttsandrew]

Are you having the same issue currently being discussed in this thread?

Timezone issues. Logs are shown 1 hour behind

Good evening, Currently scratching my head over timezone issue. I have all timezones for all servers unified as “Europe/London”. System/Overview/Time configuration shows correct time: User admin :2020-08-25 17:22:34 +01:00 Your web browser:2020-08-25 17:22:34 +01:00 Graylog server:2020-08-25 17:22:34 +01:00 Additionally, the messages I am sending into Graylog via Filebeat are also ‘Europe/London’ timezone. The problem is that Graylog is only showing default UTC timezone for message entr…

[servicedesk (Olivier)]

Yes this looks exactly the same issue. I will keep on following this post. Thanks for pointing this out.

regards

[servicedesk (Olivier)]

when I do a search 2 hours later ( the time now being 9:54) and do a absolute search for 11:54 the message is showing in the GUI

[shoothub]

Check my previous post, it should help you:

I get a log For Device system Alerts received message but No results on search page Help Me

Normal behavour if you have problem with timestamps. Check your device and graylog uses NTP synchronized time Check that you use correct timezone in device Check that you use correct timezone in Linux in graylog box Run command timedatectl and check fields Timezone and Local Time, Timezone should be your real timezone, and Local Time should be your actual time. If you don’t have correct timezone in graylog box chage it: Run command sudo timedatectl set-timezone "Europe/Bratislava" after that…

[servicedesk (Olivier)]

Thanks… it now works I have setup the rule and the pipeline. Very NIce !!!

I had to wait a little bit… after making the change I did not immediately worked. I checked 2 hours later and now the messages are coming in real time with the correct time stamp

kind regards

Olivier