# Time related logging/searching issue on Graylog 3.0.2

**URL:** <https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612>\
**Category:** Graylog Central (peer support)\
**Created:** [May 29, 2019, 3:02pm UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612 "2019-05-29T15:02:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![cabbott](https://avatars.discourse-cdn.com/v4/letter/c/6bbea6/32.png) [@cabbott](https://community.graylog.org/u/cabbott)\
**Post date:** [May 29, 2019, 3:02pm UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612/1 "2019-05-29T15:02:54Z")

</div>

I have a odd time related issue.

Data is being logged an hour ahead of current time (for Europe/London), and you cannot find it in a search until two hours after the time the event was actually generated!

So as an example…  
Event generated: 13:42:54  
Timestamp/timestamp on search results: Timestamp 14:42:54, timestamp 14:42:54 +01:00  
Unable to find in search results until 15:42:55 local time (Europe/London currently +01:00 from UTC due to daylight savings)

Time configuration…  
User: 14:52:00 +01:00  
Web Browser: 14:52:00 +01:00  
Graylog server: 14:52:00 +00:00

The hour difference between the generated event and the Timestamp/timestamp field may be explained by the fact I’m forwarding the events from my previous Graylog server using a Syslog plaintext Output to this new server as I’m testing and ironing out issues.  
The thing that concerns me is that the entry cannot be found in a search until two hours after it was logged.

I’m guessing the issue is timezone related, but I’m unclear what to do to resolve it.

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [May 30, 2019, 11:38am UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612/2 "2019-05-30T11:38:21Z")

</div>

> [@cabbott](#):
>
> Time configuration…  
> User: 14:52:00 +01:00  
> Web Browser: 14:52:00 +01:00  
> **Graylog server: 14:52:00 +00:00**

Set the time correctly on your server.

---

<div class="post-metadata">

**Author:** ![cabbott](https://avatars.discourse-cdn.com/v4/letter/c/6bbea6/32.png) [@cabbott](https://community.graylog.org/u/cabbott)\
**Post date:** [May 30, 2019, 1:07pm UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612/3 "2019-05-30T13:07:48Z")

</div>

As far as I can tell, the time is correct on my server…

# timedatectl

Local time: Thu 2019-05-30 14:04:36 BST  
Universal time: Thu 2019-05-30 13:04:36 UTC  
RTC time: Thu 2019-05-30 13:04:36  
System clock synchronized: yes  
systemd-timesyncd.service active: yes  
RTC in local TZ: no

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [May 30, 2019, 1:47pm UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612/4 "2019-05-30T13:47:38Z")

</div>

But somehow you post GL recognize wrong the time.  
IT should be this:

> User admin:  
> 2019-05-30 15:44:25 +02:00  
> Your web browser:  
> 2019-05-30 15:44:25 +02:00  
> Graylog server:  
> 2019-05-30 15:44:25 +02:00

Same time and zone every line.

---

<div class="post-metadata">

**Author:** ![cabbott](https://avatars.discourse-cdn.com/v4/letter/c/6bbea6/32.png) [@cabbott](https://community.graylog.org/u/cabbott)\
**Post date:** [May 30, 2019, 2:31pm UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612/5 "2019-05-30T14:31:29Z")

</div>

Thanks for the heads up, that gave me the clue I needed.

Turns out the Timezone was incorrect on Ubuntu, despite me thinking I had changed it.  
Had to run “dpkg-reconfigure tzdata” to correct it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 13, 2019, 2:31pm UTC](https://community.graylog.org/t/time-related-logging-searching-issue-on-graylog-3-0-2/10612/6 "2019-06-13T14:31:32Z")

</div>

Closed on June 13, 2019, 2:31pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
