This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Wrong time shown in Logging & Reporting

I don't know what to make of this. The time is correct in the Dashboard and in the log files but it's four hours ahead in all of the graphs in Logging & Reporting:

I also get the correct, local date/time when I SSH into the unit and run the date command. What would cause the time to be wrong in only the graphs?

Does anyone else see this on any of their UTM's?

I have tried installing Sophos UTM with and without ticking the Host is UTC time option during installation. I get the same results.



This thread was automatically locked due to age.
  • i think one time is UTC and the other one your local time.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

  • I've not seen this before and just checked mine by comparing the same two spots you have posted.

    Mine are matching times.

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • I'm sure that's what it is but I cannot get the times to match.

    --------------------------------------------------------------------
    Sophos UTM 9.719-3 - Home User
    Virtual machine on Dell Optiplex 3070
    i3-9100 @ 3.60 GHz, 16 GB RAM
    --------------------------------------------------------------------

  • This is weird. I'll try a fresh install and not add my backup to the root of the USB so that it does not auto restore.

    --------------------------------------------------------------------
    Sophos UTM 9.719-3 - Home User
    Virtual machine on Dell Optiplex 3070
    i3-9100 @ 3.60 GHz, 16 GB RAM
    --------------------------------------------------------------------

  • One thing that comes to mind is that maybe I had the Host is UTC time ticked when I originally installed the UTM, years ago, and that is some how messing up the time. Does anyone know if there is a file that can be checked or edited manually?

    I get the following so the system is set to local time, not UTC:

    gateway:/root # date
    Tue Jun 7 19:46:10 EDT 2022

    gateway:/root # cat /etc/adjtime
    0.000000 1654645037 0.000000
    1654645037
    LOCAL

    I'm thinking there must be a Sophos file, somewhere, that still has the system listed as UTC.


    UPDATE:

    Now I'm thinking this is a bug of some sort because I get the same results on fresh installs of 9.711-5.1 without restoring my backup.

    I’m surprised no one else has reported encountering this issue. I have tried numerous fresh installs, with the latest iso (9.711-5.1), on three different boxes and I get the same results every time. It does not matter if I keep the Host is UTC ticked or untick it during installation. The displayed times in the Logging & Reporting graphs are always wrong ( 4 hrs. ahead). The only way that I can get those times to match the actual local time and to match the time displayed in the Dashboard is to set the time zone in Management->System Settings -> Time and Date ->Set Timezone to Etc/UTC but it should be set to America/New_York.

    Below are my settings:

    Shouldn't all of the following statements be true when considering the settings depicted in the image directly above:

    1. My current time, in my location (EDT) is 9:43 AM.
    2. The RTC (BIOS) clock is 9:43 AM.
    3. The clock on the Dashboard should be 9:43 AM.
    4. The time displayed on the far right of the Logging & Reporting graphs should be 9:43 AM or thereabouts.

    What do you guys select when you install? Do you leave everything set to defaults and change the time later in the webadmin? Do you untick the Host is UTC time setting?


    UPDATE 2:

    Now I'm at a total loss. I've downloaded several UTM ISO's, of previous versions, and I got the same results with every install going back to v9.105.

    --------------------------------------------------------------------
    Sophos UTM 9.719-3 - Home User
    Virtual machine on Dell Optiplex 3070
    i3-9100 @ 3.60 GHz, 16 GB RAM
    --------------------------------------------------------------------



    add code
    [edited by: jeffshead at 11:55 PM (GMT -7) on 7 Jun 2022]
  • Is your time zone set to Etc/UTC? That is the only way that I get get the times to match.

    --------------------------------------------------------------------
    Sophos UTM 9.719-3 - Home User
    Virtual machine on Dell Optiplex 3070
    i3-9100 @ 3.60 GHz, 16 GB RAM
    --------------------------------------------------------------------

  • My time zone is Central.

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • When I do an install, I make sure the BIOS is correct first (or as close to it as possible) and select my normal time zone when installing.

    I'm wondering if you don't have some sort of BIOS issue going on with your machine, the BIOS battery is bad/dead or maybe your ISP has got some kind of issue with NTP protocol that is redirecting traffic somehow (I know this last one is a long shot, lol) but something is interfering.

    Have you also double checked your NTP pool to make sure its accessing NTP?

    OPNSense 64-bit | Intel Xeon 4-core v3 1225 3.20Ghz
    16GB Memory | 500GB SSD HDD | ATT Fiber 1GB
    (Former Sophos UTM Veteran, Former XG Rookie)

  • I've tried four different machines, now. I set my time in the BIOS to my current, local time. I select my correct  timezone when installing. I tried leaving Host is UTC ticked and unticked. I have tested NTP. It comes back 1ms to 4ms so it is working. Keep in mind the time is correct everywhere else except for Logging & Reporting. Only Logging & Reporting is UTC.

    --------------------------------------------------------------------
    Sophos UTM 9.719-3 - Home User
    Virtual machine on Dell Optiplex 3070
    i3-9100 @ 3.60 GHz, 16 GB RAM
    --------------------------------------------------------------------

  • I feel so stupid now. It never entered my mind to check client-side.

    A few months ago, I enabled privacy.resistFingerprinting in most of my Firefox browsers. With that enabled, Firefox tells all websites, "I'm in the UTC time zone".

    Disabling that fixed the issue.

    Thanks for the responses, guys!

    --------------------------------------------------------------------
    Sophos UTM 9.719-3 - Home User
    Virtual machine on Dell Optiplex 3070
    i3-9100 @ 3.60 GHz, 16 GB RAM
    --------------------------------------------------------------------