# Some logs appear very late **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 21, 2020, 9:20am UTC](https://community.graylog.org/t/some-logs-appear-very-late/18269 "2020-12-21T09:20:09Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Cruciani\_Elliot](https://avatars.discourse-cdn.com/v4/letter/c/b4bc9f/32.png) [@Cruciani\_Elliot](https://community.graylog.org/u/Cruciani_Elliot)\ **Post date:** [December 21, 2020, 9:20am UTC](https://community.graylog.org/t/some-logs-appear-very-late/18269/1 "2020-12-21T09:20:09Z")
Hello, I just set up a Graylog server to receive authentication logs from all the servers on my network and it seems to be working fine. All servers in the network first send their logs to a syslog server, there is one for the dmz and one for the internal zone. Here is the configuration on each server in the/etc/rsyslog.conf file (here the server sends the logs to the internal syslog, it is the conf of one of the servers that has a problem): ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fe903690d55ba1206b1c8bcf5abfd5ecf14c0e9f.png) So far I have no problem, all the logs of all the servers arrive well in my syslog server, which stores them in a folder specific to each server. Example of a conf file for a server on my syslog server in/etc/rsyslog. d/ : ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c525b3d33bc60c75cf97d74ee1838e1e9ab6db4e.png) And here is the configuration of my syslog server rsyslog file so that it sends all connection logs to the graylog server: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/dcff6a83c262ad1e3e3237de8f5ab45ea5c92ebe.png) However, the problem shows up on my graylog server. While my configuration is the same on each server, The connection logs of some servers do appears very late on my graylog. While they arrive immediatly on my syslog server and it sends all the connection logs it has. That’s why I can’t understand the problem. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/33ae068c7e6ebf0433c53f98e72a07a829366256.png) For example, you can see here logs from a server, but not authentification logs (while I logged on several times on) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7c72e7dd60cfa92b143f41a9a39f151fac8a4832.png) I would like to point out again that this is only for a few servers, as we can see here on a working server: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9bb534779a409a4422df7924735b941ed07c31a5.png) The message appeared instantly Thanks to those who will try to help me ---
**Author:** ![aaronsachs](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aaronsachs/32/7180_2.png) [@aaronsachs](https://community.graylog.org/u/aaronsachs)\ **Post date:** [December 21, 2020, 6:32pm UTC](https://community.graylog.org/t/some-logs-appear-very-late/18269/2 "2020-12-21T18:32:07Z")
@Cruciani_Elliot on its face this seems like it may be an issue with timezones being set incorrectly, whether on the server or on the message. If you do an absolute search say from now, to a day in the future, do you see any logs showing up in the future? ---
**Author:** ![Cruciani\_Elliot](https://avatars.discourse-cdn.com/v4/letter/c/b4bc9f/32.png) [@Cruciani\_Elliot](https://community.graylog.org/u/Cruciani_Elliot)\ **Post date:** [December 22, 2020, 8:56am UTC](https://community.graylog.org/t/some-logs-appear-very-late/18269/3 "2020-12-22T08:56:14Z")
hi @aaronsachs, I didn’t suceed to see any logs in the future with the absolute search, but it was, as you said, a timezone problem. I compared a functional server and another that sent the logs late with the command "date "and actually they were delayed by 1h towards the future. Now that I have set the time I finally get the connection logs when the connection took place. Thanks a lot! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 5, 2021, 8:56am UTC](https://community.graylog.org/t/some-logs-appear-very-late/18269/4 "2021-01-05T08:56:21Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.