Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

ACS logging to syslog server - time off 5 hours

Unanswered Question
Dec 13th, 2011
User Badges:

I am sending TACACS administration logging to a syslog server.  When the messages show up on the syslog server, they are 5 hours ahead of the actual time.  Time on the ACS is correct - local logging shows the correct time.  Time on the syslog server is correct...all other devices/systems sending syslog messages to it are coming through with the correct time. 

Any ideas as to why the ACS syslog messages would be 5 hours ahead?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Tarik Admani Thu, 12/15/2011 - 21:40
User Badges:
  • Green, 3000 points or more

Are you in the eastern timezone (or are the ACS located there), I am thinking the logs are being sent in UTC format, are you using an acs appliance or is this acs for windows?

mmletzko Tue, 12/20/2011 - 05:44
User Badges:

Thanks for the reply Tarik.

We are in the EST time zone.  The time on the ACS is set correctly - all of the logs on the ACS itself are fine.  It is a 1113 appliance.

It does seem they are being sent in UTC.  Everything else on that syslog server is fine for time - it's just the ACS syslogging.

mmletzko Tue, 12/20/2011 - 10:32
User Badges:

I opened a case - solved very quickly.  There is a "Date Format Control" option in the System Configuration specifically for syslog.  Now of course I feel silly that I didn't even notice it.



This Discussion