topic Re: FTD 2130 - Changing the Syslog Time zone in Network Security

FTD 2130 - Changing the Syslog Time zone

dejan_jov1 — Fri, 21 Feb 2020 15:36:28 GMT

Hi,

Our Firepower 2130 is sending Syslogs with Timestamps in UTC Time Zone and I can't find way how to change it.

I configured in Platform settings/Time Syncronization that the FTD updates its Time from Management Center but when I do show ntp on FTD I get this output:

> show ntp
NTP Server                : 127.127.1.1
Status                    : Unknown
Offset                    : 0.000 (milliseconds)
Last Update               : 99m (seconds)

NTP Server                : 127.0.0.2
Status                    : Being Used
Offset                    : 0.278 (milliseconds)
Last Update               : 29 (seconds)

Shouldn't tere be the FMCs IP?

On FMC under User Preference the Time Zone is CET.

show time on FTD:

> show time
UTC -       Fri Apr  6 13:53:30 UTC 2018
Localtime - Fri Apr 06 09:53:31 EDT 2018

Is it possibe to change the UTC Timestamps in Syslog messages to another Time Zone?

Thanks in Advance!

Re: FTD 2130 - Changing the Syslog Time zone

Marvin Rhoads — Fri, 06 Apr 2018 16:25:29 GMT

Is your FMC a VM? If so, it is not recommended to use it as an NTP server for the sensors.

Firepower syslog messages will always have UTC timestamps. It's not an option to change that.

Re: FTD 2130 - Changing the Syslog Time zone

dejan_jov1 — Sat, 07 Apr 2018 05:41:14 GMT

Hi Marvin,

Our FMC is an VM, so we will need to use another NTP Server. Thanks!

Re: FTD 2130 - Changing the Syslog Time zone

HakamAbd79366 — Thu, 09 Jul 2020 07:53:30 GMT

Hi,

on FTD got timezone UTC (UTC+0:00), Device Management, its possible to change timezone. bcus on the FMC, have correct timezone.

Thanks

Re: FTD 2130 - Changing the Syslog Time zone

mariya.telitsina — Fri, 08 Jul 2022 11:13:35 GMT

Any news on this topic?

on my FMC 7.0 syslog messages are sent to syslog server in UTC format... kind of confusing.

Re: FTD 2130 - Changing the Syslog Time zone

Marvin Rhoads — Fri, 08 Jul 2022 13:21:37 GMT

@mariya.telitsina

Cisco sees that as the "right" way to do it per the RFC so the behavior remains as-is.

Re: FTD 2130 - Changing the Syslog Time zone

mariya.telitsina — Mon, 11 Jul 2022 03:21:35 GMT

Thank you Marvin for your reply! I googled a way to make an offset on a syslog server. will try this as a workaround.