One of the values extracted from every event is the Log Source Time field, which displays what QRadar understood as the time the event occurred on the source device. Events with a DSM created by IBM what is extracted as Log Source Time can vary depending on the payload. In this article, you can learn how to override the Log Source Time with the DSM Editor to display the time zone you need.
- For custom DSMs, you can create a Log Source Type to parse the event. In the DSM Editor, there are fields to override default parsing values. To customize the time zone, you need to override the Log Source Time field to configure what is extracted from the event as the Log Source Time. You need to review the time zone information from the payload to confirm it is used properly.
- If the event does not contain an RFC-compliant Syslog header or time information, QRadar might not be able to parse the Log Source Time from the event. QRadar supports RFC 3164 or RFC 5424 formats for Syslog events. When a format issue occurs, the DSM Editor applies the time that the event was parsed and appliance time zone to the event. If your payload does not contain an RFC-compliant Syslog header, you must apply an override to parse the Log Source Time correctly.
- When an event payload does not contain a time zone QRadar can assign a value automatically. The time zone value is set based on the installation time zone configured by the administrator. For example, if payload time is <38>Sep 24 11:21:28 hostname LEEF<...> and during the appliance installation the administrator selects New York, America EST, then QRadar falls back to the EST time zone when no Log Source Time overrides are configured.
- When the event payload does not contain a year QRadar assigns the current year as the value for Log Source Time.
- On the Log Activity tab, the Log Source Time adjusts to the time zone QRadar uses. For example, if the time extracted was <38>Sep 24 11:21:28 CST and QRadar is installed with a time zone as Eastern Standard Time (EST), QRadar displays Sep 24, 2022, 12:21:28 as the time in the Log Source Time field.
- If you need more information on how to configure the Log Source Time field in the DSM Editor, see QRadar: How to change or customize Log Source Time.
Scenario 1: Payload time do not contain a time zone, but it is the same used by QRadar
Scenario 2: Event payload contains a time zone
Scenario 3: Time in the payload does not contain a time zone, but this event source is in a different time zone than QRadar
<182>Feb 11 10:04:01 hostname<...>
Scenario 4: The time in your payload is in epoch time
- The capture group is $1.
- The letters yyyy display the year.
- The time zone GMT.
- Add a lowercase "s" for each of the epoch numbers, as the epoch on this example has 10 digits we added 10 lowercase "s". If your epoch time contains milliseconds, you need to include 13 "s" characters in the Date Format field.
- The letter 'yyyy', must be included to reference the year and it must be surrounded by single quotation marks.
- The letter zzz to tell QRadar that these three characters are the time zone.
- Epoch time: 1638387181
- GMT: Wednesday, December 1, 2021 7:33:01 PM (time zone for the epoch time in the event).
- EST: Wednesday, December 1, 2021 2:33:01 PM (time displayed in Log Source Time in the user interface).
Was this topic helpful?
07 March 2022