To finish the time in Log Insight blog series I would like to talk about timezones and more specifically how they are used and how they can be changed.
What is the default timezone?
The default timezone on the Log Insight virtual appliance is UTC.
Should the default timezone be changed?
No. The goal for Log Insight is to provide a standard time across all instances whether they are clustered or not. The timezone does not need to be changed because when issuing a query in Log Insight the timezone used for the query is always the timezone of the browser used to access Log Insight. In short, the timezone on the virtual appliance has no impact on queries in Log Insight.
What if I want to view logs in a different timezone than the browser?
Today, Log Insight always displays logs based on the timezone of the browser. One workaround to this issue is to just change the timezone of the system your browser is running on. If you would like to see an option in Log Insight to change the behavior of how logs are shown then please vote for this feature here.
How do I change the timezone anyway?
If you really want to change the timezone then you must do so from the CLI. The timezone information is stored in /etc/localtime:
# cat /etc/localtime TZif2UTCTZif2UTC UTC0
By default, this file is a symbolic link:
# ls -l /etc/localtime lrwxrwxrwx 1 root root 27 May 10 2013 /etc/localtime -> /usr/share/zoneinfo/Etc/UTC
If you want to change the timezone, link a different timezone to this file:
# ln -sf /usr/share/zoneinfo/America/Chicago /etc/localtime
A KB article has been created for changing timezones and is available here.
© 2014 – 2021, Steve Flanders. All rights reserved.
I know it’s an older article.. but I didn’t find any better googling.. for other readers, in v4.5 atleast, the localtime file is a hardlink to /usr/share/zoneinfo/UTC.
Anyway.. Is it still not recommened to change the localtime on the vRLI server (4.5)? It’s a bit annoying to troubleshoot vRLI and reading it’s local logs when the time is in UTC instead of local time. What problems could/will it present us if we change local timezone?
Hey Christoper — Changing the timezone would not be recommended or supported. Are you forwarding LI logs to a dedicated LI instance? If so, then you could view the logs in your local time zone.
Hi Stephen ,
can I know how do i change the time format that shows up in LI interface ?
Do I have an option to change it ?
It is set based on the browsers timezone — if you change your browser timezone and refresh, the UI will update. No other way to change today.