×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

ACS 4.2.1.15.4 logging to syslog server - time off 5 hours

Unanswered Question
Dec 13th, 2011
User Badges:

I am sending TACACS administration logging to a syslog server.  When the messages show up on the syslog server, they are 5 hours ahead of the actual time.  Time on the ACS is correct - local logging shows the correct time.  Time on the syslog server is correct...all other devices/systems sending syslog messages to it are coming through with the correct time. 


Any ideas as to why the ACS syslog messages would be 5 hours ahead?


Thanks!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Tarik Admani Thu, 12/15/2011 - 21:40
User Badges:
  • Green, 3000 points or more

Are you in the eastern timezone (or are the ACS located there), I am thinking the logs are being sent in UTC format, are you using an acs appliance or is this acs for windows?

mmletzko Tue, 12/20/2011 - 05:44
User Badges:

Thanks for the reply Tarik.


We are in the EST time zone.  The time on the ACS is set correctly - all of the logs on the ACS itself are fine.  It is a 1113 appliance.


It does seem they are being sent in UTC.  Everything else on that syslog server is fine for time - it's just the ACS syslogging.

mmletzko Tue, 12/20/2011 - 10:32
User Badges:

I opened a case - solved very quickly.  There is a "Date Format Control" option in the System Configuration specifically for syslog.  Now of course I feel silly that I didn't even notice it.


Thanks!

Actions

This Discussion