FTD 2130 - Changing the Syslog Time zone

[dejan_jov1]

Hi,

Our Firepower 2130 is sending Syslogs with Timestamps in UTC Time Zone and I can't find way how to change it.

I configured in Platform settings/Time Syncronization that the FTD updates its Time from Management Center but when I do show ntp on FTD I get this output:

> show ntp
NTP Server                : 127.127.1.1
Status                    : Unknown
Offset                    : 0.000 (milliseconds)
Last Update               : 99m (seconds)

NTP Server                : 127.0.0.2
Status                    : Being Used
Offset                    : 0.278 (milliseconds)
Last Update               : 29 (seconds)

Shouldn't tere be the FMCs IP?

On FMC under User Preference the Time Zone is CET.

show time on FTD:

> show time
UTC -       Fri Apr  6 13:53:30 UTC 2018
Localtime - Fri Apr 06 09:53:31 EDT 2018

Is it possibe to change the UTC Timestamps in Syslog messages to another Time Zone?

Thanks in Advance!

[Marvin Rhoads · Accepted solution]

Is your FMC a VM? If so, it is not recommended to use it as an NTP server for the sensors.

Firepower syslog messages will always have UTC timestamps. It's not an option to change that.

[dejan_jov1]

Hi Marvin,

Our FMC is an VM, so we will need to use another NTP Server. Thanks!

[HakamAbd79366]

Hi,

on FTD got timezone UTC (UTC+0:00), Device Management, its possible to change timezone.  bcus on the FMC, have correct timezone.

Thanks

[mariya.telitsina]

Any news on this topic?

on my FMC 7.0 syslog messages are sent to syslog server in UTC format... kind of confusing.

[Marvin Rhoads]

@mariya.telitsina 

Cisco sees that as the "right" way to do it per the RFC so the behavior remains as-is.

[mariya.telitsina]

Thank you Marvin for your reply! I googled a way to make an offset on a syslog server. will try this as a workaround.