How do I enable UTC support, and what are the implications?

Starting with v3.0, UTC support is automatically enabled in EventSentry for new installations and affects all time stamps viewed through the web reports. This is extremely useful for installations which span multiple time zones, as it allows for all data to be displayed in a single, configurable time zone (usually the time zone of the user viewing the reports).

With earlier versions of EventSentry, each agent would report data records in the time zone it was located in, making it somewhat difficult to correlate data from hosts in different time zones.

If you are performing a fresh installation of EventSentry 3.0, then UTC support is automatically enabled and no further configuration is necessary. The web reports will automatically detect the current time zone, which can also be manually configured through the Settings - Preferences menu.

Important: If you are upgrading from an earlier version of EventSentry, review the information below BEFORE enabling UTC support. In some cases, starting over with a new database may be recommended:

• 1. Once UTC support is enabled, it cannot be disabled again
• 2. All data reported by agents prior to the switch to UTC will be offset (and incorrect) in the web reports, depending on the time zone setting in the web reports. More details below.
• 3. After UTC support has been enabled, some time stamps reported by the agents may be in the future for up to 24 hours. More details below.
• 4. UTC support is enabled through the management console in the Global Options.
• 5. UTC support is only available in the new 3.0 web reports. The legacy IIS-based web reports do not support UTC.
• 6. After enabling UTC support, the configuration should be pushed to all hosts at the same time.
• 7. After enabling UTC support, navigate to the web reports to select the time zone you are in. Navigate to Settings - Preferences and select the time zone. Then, navigate to Settings - Profiles, and enable the "UTC" checkbox in the Database Connection section of the settings.

Important - Incorrect Time Stamps after enabling UTC
After you enable UTC support and push the configuration to all remote agents, all records written by the agents prior to the enabling UTC support, will be off by a few hours. The amount of hours the time stamps are off depends on the offset between the configured time zone (see 7 above) and UTC time. For example, if you selected US Eastern Time (EDT), then the web reports will subtract 5 hours (4 during DST) from all records returned from the database. While this is correct for records written with UTC time stamps, it is not for time stamps written in the local time of the agents prior to the switch.

Consequently, the web reports will potentially show duplicate data, or data which is seemingly in the future, for up to 24 hours after UTC support has been enabled. The time period depends on the time zone selected in the web reports, and the time zone an agent is in. For example, if you are located in the Eastern Timezone but have an agent in Japan which wrote the last entry (prior to enabling UTC support) in local time, then duplicate data would be reported for 4 hours.

If this overlap and potentially incorrect data is not acceptable, you can create a new EventSentry database which will only contain data in UTC format.