Timezone Graylog Server

Graylog Central (peer support)
1

Hello
I’m having a problem with the time setting on my graylog server. My server’s date and time setting is correct.

Qua Out 24 16:12:04 -03 2018

The configuration in the .conf file is also in correct timezone (gmt -3). But it does not appear correctly in the “Overwiew” web of Graylog, as can be seen below. The configuration is timezone America / Sao_Paulo (gmt -3) in .conf and also on the server, but it appears in the panel with gmt -2 for user admin and graylog server. Can someone guide me?

User admin : 2018-10-24 17:19:07 -02:00
Your web browser: 2018-10-24 16:19:07 -03:00
Graylog server: 2018-10-24 17:19:07 -02:00

root@graylog:/home/austacem# ntpq -c pe

remote refid st t when poll reach delay offset jitter

+Time100.Stupi.S .PPS. 1 u 43 512 377 240.094 0.259 0.964
+a.ntp.br 200.160.7.186 2 u 15 512 377 1.294 0.504 0.268
-ntp.gnc.am 42.204.179.159 2 u 144 512 377 276.642 -4.064 3.692
*a.st1.ntp.br .ONBR. 1 u 94 512 377 1.150 0.662 0.128

root@graylog:/home/austacem# zdump /etc/localtime
/etc/localtime Wed Oct 24 16:22:56 2018 -03
zdump: warning: zone “/etc/localtime” abbreviation “-03” lacksalphabetic at start

2

Should you refer to the timezone given in root_timezone I’ll like to point to the Documentation and quote:

Graylog saves the dates in UTC, the Timezone that is set per user (in the profile) is then used to Display the Timestamp.

Why the TimeZone is displayed different from what is configured can have multiple reasons, having a typo is the most common … Did you tried the alias for your timezone Brazil/East?

In your server.conf

root_timezone = Brazil/East
3

Yeah, I already tried that. I changed the timezone and rebooted the service, but it did not work.

root_timezone = Brazil/East

4

when you create a local user, login with that user and set the timezone to Brazil/East for this user. Is that displayed correct?

5

I did this test with a local user. For some reason Graylog will not let me put timezone “Brazil / East” on the local user. Every time I do this and give the “update user” the timezone field automatically returns to “Sao_Paulo”, but if I put any other timezone I can change it. At this moment I put the timezone “Maceio”, and the information in the Overview has been corrected.
I did the same in the .conf file by putting Timezone America / Maceio. I restarted the service and nothing happened. The graylog_server time is still wrong.

User x:
2018-10-25 12:43:50 -03: 00
Your web browser:
2018-10-25 12:43:50 -03: 00
Graylog server:
2018-10-25 13:43:50 -02: 00

6

@cleytons but Graylog server means the OS - not the JVM Process.

And again:

This setting is nothing that changes Graylogs behavior… expect how the time is displayed for the build in root user.

7

Ok I understood
root_timezone = UTC
The time zone setting of the root user. See this list of valid time zones. Default is UTC.

I just do not understand why even in the local user it does not accept the exchange of timezone for Brazil / East and when I try to place this timezone it forces America / Sao_Paulo.

8

What you asked for:

User admin:
2018-10-25 13:24:53 -03:00
Your web browser:
2018-10-25 13:24:53 -03:00
Graylog server:
2018-10-25 14:24:53 -02:00

9

And also I do not understand why with the timezone America / Sao_Paulo in the .conf file the “Time Configuration” of the user admin is incorrect.

10

I’m facing the same issue on Graylog.

The situation is that daylight saving time in Brazil will from 2018 be starting on the first sunday of nov, instead of the third sunday of oct.

# timedatectl 
      Local time: Thu 2018-10-25 13:12:24 -03
  Universal time: Thu 2018-10-25 16:12:24 UTC
        RTC time: Thu 2018-10-25 16:12:24
       Time zone: America/Sao_Paulo (-03, -0300)
     NTP enabled: yes
NTP synchronized: no
 RTC in local TZ: no
      DST active: no
 Last DST change: DST ended at
                  Sat 2018-02-17 23:59:59 -02
                  Sat 2018-02-17 23:00:00 -03
 Next DST change: DST begins (the clock jumps one hour forward) at
                  Sat 2018-11-03 23:59:59 -03
                  Sun 2018-11-04 01:00:00 -02

Time configuration
User : 2018-10-25 14:18:12 -02:00
Your web browser:2018-10-25 13:18:12 -03:00
Graylog server: 2018-10-25 14:19:37 -02:00

I’m not sure if this is an OS problem.

11

Well I have to say that in my case I’ve used the OVA image and then use the Ctl script to configured time zone and all 3 times agree in the overview screen:

User admin :2018-10-25 19:33:09 -07:00
Your web browser:2018-10-25 19:33:09 -07:00
Graylog server:2018-10-25 19:33:09 -07:00

From CLI this is what I see:

ubuntu@graylog:~$ timedatectl 
      Local time: Thu 2018-10-25 19:30:03 PDT
  Universal time: Fri 2018-10-26 02:30:03 UTC
        Timezone: America/Los_Angeles (PDT, -0700)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: yes
 Last DST change: DST began at
                  Sun 2018-03-11 01:59:59 PST
                  Sun 2018-03-11 03:00:00 PDT
 Next DST change: DST ends (the clock jumps one hour backwards) at
                  Sun 2018-11-04 01:59:59 PDT
                  Sun 2018-11-04 01:00:00 PST
ubuntu@graylog:~$
12

https://github.com/Graylog2/graylog2-server/pull/5247

It seems that it will be necessary to update the time zone database.

13

Is this related ONLY to non-North American time zones? Why is it that US users aren’t affected by this? Or am I missing a piece of information?

14

I’m not sure but i think countries that recently changed DST date schedule may be affect.

15

Hello, are you referring to the update of timezone data tzdata?

16

The time zone database that is used on Graylog web interface.
I don’t think it is tzdata.

17

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.