Commodore Commodore
Commodore
559 views

Report Time Difference

Hi,

When i try to execute a report from ESM, i am able to see a two hour time difference.

For Eg: it i try to execute from 3pm to 4pm, the report is getting executed from 2pm to 3 pm.

i have checked the manager time and also all the reports are configured to use manager time zone.

however i do not see this issue for active channels.

Please Assist.

Thanks,
Sahaya

Labels (1)
0 Likes
7 Replies
Absent Member.
Absent Member.

The Manager Receipt Time (the time at which event is received by the ESM) and End Time (the actual event occurrence time) are different. Typically, you would be seeing the Manager Receipt Time in the Active channel. However, your report runs based on End Time, which is why you are seeing the time difference in your reports.

One reason the two fields are drastically different could be due to the SmartConnector configuration. If you right click on the connector in the ESM, and in the Default tab, look at the Time Correction properties: you will see a field Set Device TimeZone to.. if the current time zone is different from the time zone of your source, this issue occurs. Set the value of this field to "Disabled" and try restarting the connector.

Hope this helps!

0 Likes
Commodore Commodore
Commodore

Hi,

Thanks for the Response.

But My Case is Different.

There is no issue / difference in the ET/MRT when viewed from the console.

both the time are getting delayed by two hours when it is exported to csv/html/pdf.

Eg: A Log where both the ET/MRT is 11:00 AM when viewed in the console.

The same Log When it is getting exported, it shows as 9:00 AM

Also there is no issue with the time correction that is enabled and more ever this issue with  all the log sources and not specific to connector.

Thanks,
Sahaya

0 Likes
Cadet 1st Class
Cadet 1st Class

Hi,

I am also experiencing the same problem. The report is adding 07 hours to the actual run time.

In active channel if run for a particular duration it shows logs for the that particular duration but when i export the same logs 07 hours is added up to the actual time.

Kindly let me know if you have solved the issue.

0 Likes
Absent Member.
Absent Member.

Hi,

I have faced the an issue almost similar to this . In my case , Arcsight Reports and Rules was showing the time in GMT , instead of AST. We can see everything perfect in Console. But when we ran any report , output will show GMT.

That time, i opened a ticket with ArcSight support and they took a webex session and fixed the issue.

---------------------------------------------------------------------------------------------------------------------------------------------------------------

Please find the below explanation from ArcSight Support :

The issue was with local time configuration.

The actual time is taken from the file /etc/localtime which is a symbolic file of /usr/share/zoneinfo/Asia/Riyadh.

Before performing the symbolic link, the command date returned the correct AST time zone date, because the value was taken from /etc/sysconfig/clock.

The time zone in the /etc/sysconfig /clock was correct and the command "date" returned the right date & time, showing AST time zone.

In Linux, for the time on the machine to reflect the change timezone we need to link the zoneinfo file to /etc/localtime.

In Red Hat, the value in /etc/locatime was not correct (although the command date returned the correct time zone, AST).

It was causing the timestamp in the logs, reports and notifications to be shown as GMT.

To fix the issue, one must create a symbolic link to the correct time zone, that is:

ln -sf /usr/share/zoneinfo/Asia/Riyadh /etc/localtime

After the machine must be rebooted to take effect.

------------------------------------------------------------------------------------------------------------------------------------------------------

It will be better to open a ticket with ArcSight Support.

regards,

adhil

0 Likes
Cadet 1st Class
Cadet 1st Class

Hi Abdula,

Thank you for replying. I will check it out and let you know.

0 Likes
Absent Member.
Absent Member.

Hi Devasis Mahato,

I am also facing the same problem.

Kindly let me know if you have solved this issue.

0 Likes
Cadet 1st Class
Cadet 1st Class

Hi Vinoth,

I have not solved the issue fully but for the reports i have changed the time zone to PST in the Report Parameter settings, so for the reports the issue has been resolved but even now if i am exporting the data from the active list the problem continues.

Kindly let me know if you find any solution for this.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.