Hi Jorg, as Eric already mentioned, the best practice is to run all servers and all network appliances on UTC and not a local timezone which is prone to DST.
This being said, you could probably write Drools rules to adjust the timestamps/timezone of those devices: http://docs.graylog.org/en/2.0/pages/drools.html Cheers, Jochen On Thursday, 18 August 2016 20:06:13 UTC+2, Jorg B wrote: > > I'm using Graylog 2.03 and I'm having some issues with the one hour time > difference introduced by daylight saving time. > We have 1000's of devices syslog'ing to our Graylog server. Even though > these devices have the correct timezone configured (PST), they don't > auto-adjust for daylight saving time... which means that the time stamp for > each message on the Graylog server is off (behind) by one hour. I could > manually adjust the time zone to a zone that is one hour ahead, but given > the number of devices we have, this is not feasible (and plain dumb). > Since I also have devices with the correct time logging to the same > Graylog server, changing the time on the server is not solving the problem > either. > I need to have the time stamps adjusted to reflect the correct time, so > that my stream condition rules can work correctly. > What is the best way to handle this? Is a extractor converter what I'm > looking for? > > Thanks for the help > > JB > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/1d575f0f-e095-4019-a349-9bb9915d283a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
