How does a firewall of USG9500 V300R001C01 process the timestamps carried in logs?
The firewall processes timestamps in the logs of different types as follows:
In the session logs output by the firewall in binary or netflow format, the timestamps are fixed to the UTC timestamps by default. Upon receiving the logs, the LogCenter modifies the timestamps in the logs based on the local time zone to ensure that the time of the logs is consistent with the local time. Then, it displays the log information on the web-based pages. In this way, the log receiving time (local time of the LogCenter) and the time contained in the logs, displayed on the LogCenter, have no deviation.
In the session logs, packet discard logs, Port Range logs, and system logs output by the firewall in syslog format, by default, the timestamps in the log headers are the UTC timestamps and can be adjusted to local timestamps.
For session logs, packet discard logs, and Port Range logs, you can run the firewall log syslog header defaulttimestamp { utc | local | none } command to adjust the timestamps; for system logs, you can run the info-center loghost timestamp { local | utc } command to adjust the timestamps.
