Issue
SQL search results for syslog integrations show a discrepancy of an hour or more between rc_timestamp and timestamp fields.
Environment
Red Canary Portal
Security Data Lake (Search), Syslog ingest
Resolution
This is expected behavior for integrations where the syslog source is sending messages using a local time without including timezone details. Red Canary is investigating improvements to mitigate this discrepancy in a future release.
Whenever possible, syslog sources should be configured to use RFC-5424 protocol, instead of RFC-3164, to increase likelihood a UTC offset is included in messages.
Cause
The rc_timestamp value represents when a syslog message was ingested by Red Canary, while the timestamp field is extracted directly from the content of the syslog message itself, which is using a local timezone but displayed in UTC without offset.