To finish the time in Log Insight blog series I would like to talk about timezones and more specifically how they are used and how they can be changed.
What is the default timezone?
The default timezone on the Log Insight virtual appliance is UTC.
Should the default timezone be changed?
No. The goal for Log Insight is to provide a standard time across all instances whether they are clustered or not. The timezone does not need to be changed because when issuing a query in Log Insight the timezone used for the query is always the timezone of the browser used to access Log Insight. In short, the timezone on the virtual appliance has no impact on queries in Log Insight.
What if I want to view logs in a different timezone than the browser?
Today, Log Insight always displays logs based on the timezone of the browser. One workaround to this issue is to just change the timezone of the system your browser is running on. If you would like to see an option in Log Insight to change the behavior of how logs are shown then please vote for this feature here.
How do I change the timezone anyway?
If you really want to change the timezone then you must do so from the CLI. The timezone information is stored in /etc/localtime:
# cat /etc/localtime TZif2UTCTZif2UTC UTC0
By default, this file is a symbolic link:
# ls -l /etc/localtime lrwxrwxrwx 1 root root 27 May 10 2013 /etc/localtime -> /usr/share/zoneinfo/Etc/UTC
If you want to change the timezone, link a different timezone to this file:
# ln -sf /usr/share/zoneinfo/America/Chicago /etc/localtime
A KB article has been created for changing timezones and is available here.
© 2014 – 2021, Steve Flanders. All rights reserved.