Hi Ccns90
Email alert utilizes the system time which is configured to UTC and cannot be changed.
Based on what you mentioned I am assuming that your time zone is UTC+4 correct? (since the time difference is 4hours between what you see in the FMC event viewer; that is showing you the logs per the configured timezone and the timestamp you saw in the email alert) which should explain what you are seeing, the timestamp with email alerts is based on UTC (system time) and per my knowledge this can't be changed like Intrusion alerts for example (if you checked the Intrusion email tab under Alerts you will see that there is an option for timestamp, but for other alert that option doesn't exist).
Hope this gives you some clearance.
Regards
Raed
Thank you Raed Boshmaf. Your explanation is so clear
Is there other way to configure correlation send me email with correct timestamp?