Video Screencast Help

Notification using GMT instead of local time zone

Created: 23 Apr 2010 • Updated: 21 Jun 2010 | 5 comments
This issue has been solved. See solution.

The Event time and Database insert time are GMT instead of my local time (PST) in the email notification:

  • Event time: 2010-04-23 15:04:35 GMT
  • Database insert time: 2010-04-23 15:09:51 GMT
     

The actual event time was 08:04:35 PST (Pacific Standard Time) which is actually (UTC-08:00) Pacific Time (US & Canada).

The SEPM server, the client, and my computer all have the correct time zone set.  I see there are previous forum posts regarding this from 1 year ago or more.  I'm running RU6.  How can the notification be fixed to show the correct local time?

Discussion Filed Under:

Comments 5 CommentsJump to latest comment

blenahan's picture

How about this:

From the SEPM Home Screen, click on the Preferences link in the Security Status window:

Click on the third tab, Logs and Reports

Set option for Time Zone Used in Export: to Local

Click OK

 

_________________________________________________________________

Please remember to mark the thread 'SOLVED' with the answer that most helped you by choosing 'Mark As Solution' on the applicable answer

sandeep_sali's picture
 
Notification Emails show all Event Times in GMT

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010012915495548

The SEPM logs all events using UTC (Coordinated Universal Time), also known as GMT (Greenwich Mean Time). This enables all of the events to be normalised, allowing for SEP clients from multiple time-zones to forward their events to the same SEPM and for all of these events to be correctly tracked and coordinated.

 
When Notifications are configured for specific event criterea, these notifications are generated and stored within the database, based on the UTC/GMT data (the client data is converted to UTC before being written into the database).  Consequently, if the administrator configures an email alert based on the notification, the text of the email alert will show the event time in UTC (GMT).
 
However, if the administrator logs into the SEPM and view the same event via the Reports interface, the SEPM will automatically convert the timestamp of the event to match the local time configuration of the SEPM. Thus a SEPM configured to be in Pacific Standard Time (GMT -8) will log all events using UTC/GMT, but will display them as PST (GMT -8). 
 

Thanks & Regards

Sandeep C Sali

SOLUTION
RickJDS's picture

I don't understand how this is a solution.  The OP wants local time used for notifications.  I'd like to see all email notifications in local time.  GMT is useless to me.

ENG506RESQ's picture

I agree with Rick, this isn't a solution. I'd like the timestamp in the notification emails to be in the local timestamp of the SEPM server or at least the option to change it back and forth. Hey maybe even a second line for the local timestamp where the event occured, so if I have a system in San Diego that encountered an alert, it would tell me when the event occured in my local time and then the client's local tiem.

I don't understand why this is so hard? It seems like all the email notification settings are draconian compared with SAV. I can can't configure what's in emails, can't configure it to send me one for each alert, or change the timestamp in them. It's either Symantec's way or the highway.