Skip to main content
NOTICE: Support has moved to the Zscaler Customer Support portal. To access support, log into Zscaler MDR, click your user icon (top right), and select Support Portal.
Go to Zscaler MDR Documentation
Zscaler MDR Support

Why Is There A Timestamp Discrepancy in Security Data Lake Search?

  • Updated .

Issue

SQL search results for syslog integrations show a discrepancy of an hour or more between rc_timestamp and timestamp fields.

Environment

Red Canary Portal
Security Data Lake (Search), Syslog ingest

Resolution

This is expected behavior for integrations where the syslog source is sending messages using a local time without including timezone details.  Red Canary is investigating improvements to mitigate this discrepancy in a future release.

Whenever possible, syslog sources should be configured to use RFC-5424 protocol, instead of RFC-3164, to increase likelihood a UTC offset is included in messages.

Cause

The rc_timestamp value represents when a syslog message was ingested by Red Canary, while the timestamp field is extracted directly from the content of the syslog message itself, which is using a local timezone but displayed in UTC without offset.