Log exporter (CEF) - timezone from UTC to UTC+2

[kozinka]

Hello,

I have management R81.10 JHF take 87

I configured log exporter on our primary management server and send logs to syslog server by CEF format

Issue:

Time - RT - was in unix timestamp

Resolved by:
I modified file CefFieldsMapping.xml as:

<field><origName>time</origName><dstName>rt</dstName>
<callback>
<name>format_timestamp</name>
<args>
<arg key="format" value="%Y-%m-%d %H:%M:%S"/>
</args>
</callback>
</field>

Now, it looks like this:
Aug 23 10:49:37 192.168.168.1 CEF: 0|Check Point|VPN-1 & FireWall-1|Check Point|Log|http|Unknown|act=Accept app=HTTP destinationTranslatedAddress=0.0.0.0 destinationTranslatedPort=0 deviceDirection=0 rt=2023-08-23 08:49:37

But time differs in 2 hours. Default timezone for log exporter is UTC.

How can I configure UTC+2 please?

Thanks for answers

[PhoneBoy]

To the best of my knowledge, Log Exporter only deals in GMT
The best you can do is to change the format string to include the timezone (use %z or %Z in the format string) so it’s clear the dates are GMT.
That assumes the CEF server can correctly process that.