Time problem

[myxr6turbo]

Hi guys,

I live in Victoria, Australia and we have daylight savings. After a fresh install and I run the date command it reads 1 hour forward. If I manually enter the time from the command line it causes problems with the logs and the data is wrong. What do I need to do?

Thanks,

[weslambert]

Can you let me know where it reads 1 hour forward? In the browser? The system itself should be using UTC time.

[myxr6turbo]

If I say show me anything within the last hour nothing will show. If I say show me anything within 2 hours it will show me stuff that is 1 hour ahead of my current local time.

[jertel]

Possibly related: #1824

[myxr6turbo]

OK something strange is happening. When I built the server I did a date and it said 1 hour ahead. I did hwclock it said 1 hour ahead. When I went to alerts, ungroup to show me everything in the last hour. It was empty. I had to set it 2 hours ahead and it showed data and in the time stamp column it was 1 hour ahead of my current local clock.

I then left it over the weekend and tried to do a search today and nothing. I then ran date and its now showing 15/11/2020 21:05:59 UTC and if I run hwclock it shows 15/11/2020 09:05:59 UTC but the real date and time is 16/11/2020 8:05:00.

I have checked the ESXi server and it's showing the correct date and time.

[dougburks]

It's normal for Security Onion to set the OS timezone to UTC:
https://docs.securityonion.net/en/2.3/timezones.html?highlight=utc

[myxr6turbo]

Here is what I see after a brand new install

[dougburks]

As I mentioned above, it's normal for Security Onion to set the OS timezone to UTC:
https://docs.securityonion.net/en/2.3/timezones.html?highlight=utc

And as jertel mentioned above, there is a currently a known issue with the web interface relating to time that will be fixed in the next release.