CW2000 reporting the incorrect syslog time

[p.waller]

When looking at the Unexpected Device Report within syslog analysis, under the Resource Manager Essentials the time is 1hr behind. I need to know where the CW2000 application gets it time from. I've checked the UNIX server but the time is correct. It there somewhere within the application itself where you specify time ??

Thanks

[rmushtaq]

http://www.cisco.com/en/US/products/sw/cscowork/ps2073/products_tech_note09186a00800a7275.shtml has a section on 'How to Correct Syslog Timestamp' that may help out.

[p.waller]

Problem was fixed by stopping/starting processes on UNIX server. We're now investigating to see whether there is a bug within the software. This is a new version just installed.

[kemahnken]

Make sure the time on the SYSLOG generating device is appropriately set / synchronized. A SYSLOG message contains the time the message was sent and that is what is used by a SYSLOG receiver or at least it should be. The SYSLOG receiver just sorts the messages according to the internal time stamp. (SYSLOG common message format - Date of message, Time of message, IP/HOST of message, Error number/value, Error text) - The time will come from the "Tme of message" value.

If you're doing any type of correlation of events or event tracking having the right time is key. The easiest way to key time synchronized on a network is NTP and setting the timezone properly.