Snort mailing list archives
Events output timestamps mismatch?
From: Y M <snort () outlook com>
Date: Mon, 13 Oct 2014 15:58:02 +0000
We have a Snort instance that is configured to output both, syslog and unified2. For one particular event, Snort's unified2 record was timestamped a day (and couple hours) earlier than the timestamp of the same event output in syslog. For example, Syslog output timestamp is 2014-10-13 04:37 PM Unified2 output timestamp is 2014-10-12 10:45 AM The box is reporting the correct date/time. We have a reason to believe that the event actually occurred as reported by syslog and not the day earlier, as reported by unified2. All of the events in the unified2 file prior to and after this particular event are timestamped properly with 2014-10-13 <time>. Did anybody come across something similar? I am going through every possible scenario that could have caused this but no luck. Thanks.
------------------------------------------------------------------------------ Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer http://p.sf.net/sfu/Zoho
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Events output timestamps mismatch? Y M (Oct 13)