# Time zone problems in search

**URL:** <https://community.graylog.org/t/time-zone-problems-in-search/20582>\
**Category:** Graylog Central (peer support)\
**Created:** [July 21, 2021, 1:10pm UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582 "2021-07-21T13:10:41Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [July 21, 2021, 1:10pm UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/1 "2021-07-21T13:10:41Z")

</div>

Greetings!

I can’t figure out what the problem is. Can you please tell me how to make the time corresponding to my time zone +3?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/aef5fc71cc75981aa887bb8253468bc89019e6de.png)

---

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [July 21, 2021, 1:10pm UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/2 "2021-07-21T13:10:52Z")

</div>

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5b44edd9ed79fc4613c240fc0e912a90b5479899.png)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [July 22, 2021, 1:19am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/3 "2021-07-22T01:19:58Z")

</div>

Hello,  
Did you check your device/s date/time thats sending the log to Graylog?

---

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [July 22, 2021, 6:31am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/4 "2021-07-22T06:31:09Z")

</div>

Hello.  
In the full\_massage field, I displayed the full text coming from my device. It displays the time correctly.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 4, 2021, 2:46am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/5 "2021-08-04T02:46:41Z")

</div>

Graylog saves the dates in UTC, the Timezone that is set per user (in the profile) is then used to Display the Timestamp.

In your server.conf, is that set correctly?

`root_timezone = Chicago/America`

---

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [August 4, 2021, 6:24am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/6 "2021-08-04T06:24:01Z")

</div>

Thanks for the answer.  
Everything is correctly installed here.  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7cf06c253d2be2eb4d04009e055ea85ad93a6065.png)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [August 4, 2021, 7:51am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/7 "2021-08-04T07:51:33Z")

</div>

Hi @7neon7  
Something is probably wrong in you setup. I’ve tried your example message ine graylog 4.1.1 and was correctly parsed and also showed.

If I changed timezone for users (either admin or another user) to Europe/Minsk, everything was showed correctly: Timestamp 2021-07-21 16:02:59.000, timestamp: 2021-07-21 16:02:59.000 +03:00

Which graylog version do you use?  
Try to create new user and setup correct timezone for it. All timestamps should be showed as +03:00.

---

<div class="post-metadata">

**Author:** ![lizhimiao](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/lizhimiao/32/9257_2.png) [@lizhimiao](https://community.graylog.org/u/lizhimiao)\
**Post date:** [August 4, 2021, 8:11am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/8 "2021-08-04T08:11:09Z")

</div>

If you are using the default admin user, you have to set time zone in the graylog configuration file and restart, if you are using non-admin user, you can change time zone settings in profile page

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/cd7e169876f91a45c71665d283836a09ab1f1724.png)

---

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [August 4, 2021, 11:39am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/9 "2021-08-04T11:39:35Z")

</div>

Thanks for the advice.  
Graylog v4.1.2 + 20cd592  
Creating a new user didn’t fix the problem.

---

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [August 4, 2021, 11:43am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/10 "2021-08-04T11:43:26Z")

</div>

The time zone Minsk is set in the server.conf file and in the settings on the profile page.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d3fdf0deee8781ca4be14e15ad1f8042fd1000ef.png)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [August 4, 2021, 3:04pm UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/11 "2021-08-04T15:04:15Z")

</div>

How about your installation, which type of installation did you done? Did you upgrade you graylog installation, or it’s a new clear installation?

---

<div class="post-metadata">

**Author:** ![edwardmarrufo](https://avatars.discourse-cdn.com/v4/letter/e/35a633/32.png) [@edwardmarrufo](https://community.graylog.org/u/edwardmarrufo)\
**Post date:** [August 4, 2021, 6:01pm UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/12 "2021-08-04T18:01:41Z")

</div>

@7neon7

If everything is set correctly then I might try on the side where you are generating the messages from. Based on RFC5424 on page 12 your incoming message is missing the TIME-SECFRAC.

```auto
The originator SHOULD include TIME-SECFRAC if its clock accuracy and
   performance permit. The "timeQuality" SD-ID described in Section 7.1
   allows the originator to specify the accuracy and trustworthiness of
   the timestamp.

   A syslog application MUST use the NILVALUE as TIMESTAMP if the syslog
   application is incapable of obtaining system time.

```

---

<div class="post-metadata">

**Author:** ![7neon7](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/7neon7/32/9116_2.png) [@7neon7](https://community.graylog.org/u/7neon7)\
**Post date:** [August 12, 2021, 8:45am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/13 "2021-08-12T08:45:46Z")

</div>

It was an upgrade from 4.0 to 4.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 26, 2021, 8:46am UTC](https://community.graylog.org/t/time-zone-problems-in-search/20582/14 "2021-08-26T08:46:11Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
