Follow the steps below to set the time zone and NTP time synchronization on your Logsign server.
-
Go to Settings > System > Date & Time.
-
Select your server's time zone from the Time Zone list. Each entry shows the GMT offset and the current time in that zone, and you can type in the list to search for a zone.
-
To synchronize the clock with an NTP server, select the Use NTP check box. The NTP Server field appears after the box is selected. Enter the host name or IP address of the NTP server you want to use. You can enter more than one server by separating them with commas, for example
ntp1.example.com, ntp2.example.com. -
Click Save.
When you save, the selected time zone is applied to the server. If Use NTP is selected, time synchronization is enabled with the servers you entered. If it is cleared, NTP synchronization is turned off. On a cluster installation, these settings are applied to all nodes.
Correcting the event times of a single source
The settings above change the clock of the Logsign server. They do not change the event time (Time.Generated) that a source sends. Some sources send their event times in a different time zone than the Logsign server. Many cloud APIs, for example the Microsoft APIs, send their event times in UTC. When this happens, the events of that source appear shifted by some hours. You can correct this on the source itself with the Source Time Zone or the Offset field. Both fields are on the source form, which you open when you add a source or click edit on a source in the source list.
Source Time Zone is the recommended option. Select the time zone of the event times as Logsign receives them, for example UTC or Europe/Berlin. You can type in the list to search for a zone. Logsign converts Time.Generated from that zone to the time zone of the Logsign server and takes daylight saving time into account, so you do not have to edit the source again when the clocks change. While a time zone is selected, the Offset field is disabled and is not used. To go back to the offset, clear the Source Time Zone field. If you enter a zone that the Logsign server does not know, the source is not saved and the message "The source time zone is not known on this system. Select a different time zone." is shown.
Offset moves Time.Generated forward (+) or backward (-) by a fixed number of minutes. It is used only when no source time zone is selected. A fixed offset does not follow daylight saving time, so you have to change it by hand twice a year if the Logsign server is in a zone with daylight saving time.
Use these fields only when the event times of a source are wrong. If the source already sends its event times in the local time of the Logsign server, leave Source Time Zone empty and Offset at 0. Some integrations, for example SentinelOne, already convert the vendor time to the local time of the Logsign server. Do not select a time zone on such a source, or the time is converted twice. When a log arrives without an event time, Logsign fills Time.Generated with the time it received the log, and the source time zone does not change that value. Some pollers, such as the Office 365 Management and database pollers, fill Time.Generated with the local time when the vendor time is missing, and the selected zone or offset still changes that value. The Time.Received field is always the time of the Logsign server and is not changed by either field. If Time.Received is wrong, correct the server clock with the settings at the top of this page.