Difference between audit process results and report

If there is a difference between your audit process results and the report, check that all appliances are set to the same timezone.

Symptoms

You set a report to run on the aggregator as part of an audit process with time parameters, for example, Start of Last Day and End of Last Day. When you look at the results of that report, the first time stamps are always at a set tme after 00.00 for example, 02.00. Additionally the last time stamps are always at a set time before 23.59 for example, 21.59. However, when you run the report interactively, the time stamps are shown as expected.

Causes

The collector and aggregator time zones might not be set the same.

Environment

The aggregator is affected.

Diagnosing the problem

Check that all appliances are set to the same timezone. Use the following command. show system clock timezone.

Resolving the problem

If the collector and aggregator are not set in the same timezone, configure the timezone of the appliances with the CLI.

store system clock timezone list
store system clock timezone <timezone>

Verify that the time is correct on the appliance with the following commands.

show system clock datetime
store system clock datetime
The datetime can also be synchronized by using an NTP server with the following commands.
show system ntp all
store system ntp state
store system ntp server