Hello Manuel,
Thanks for visiting the Netwrix Community! This is something that we see with Network Devices. In fact, in an upcoming release of Netwrix Auditor 10.9, we have added the ability to adjust the time zone offset in Monitoring Plan settings directly. I do not have a release date for that update, but I will be happy to keep you posted.
My recommendation would be to wait for the update to come out, however, if you would like to update this right now, you can do so by editing the configuration.xml. It’s important to note that this file contacts the entire configuration of your installation. It’s strongly recommended to make a backup of the file beforehand.
In addition, this fix will not work if the SYSLOG message contains any kind of time zone reference.
To find your configuration.xml, you first need to know where your Working Folder is. To do that, you can run the following PowerShell command.
Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\WOW6432Node\Netwrix Auditor\DataPathOverride" -Name "(Default)”
Once you have that location, you can find the configuration file at:
%Working Folder%\AuditCore\ConfigServer\Configuration.xml
Before editing this file, you want to stop the following service
Netwrix Auditor Configuration Server Service
Once that is stopped, open the configuration.xml in any text editor. You will need to find the name of your Network Devices Monitoring Plan. You will add a new line under the line that holds the IP address of the device. The section will look like this (your IP will go where the 10.10.10.10 is).
<n n="ScopeItems" t="ScopeItems">
<n n="c11091f8-dc69-4e28-8096-9036fe4489f6" t="syslog">
<a n="audit_item_value" t="2" v="10.10.10.10"/>
I found the section by just looking for the IP address that I put into the plan. The key is, you are looking for the “audit_item_value” line.
Since you said the events are ahead by two hours, you will add the following line after the audit_item_value line.
<a n="tz" v="-2:00"/>
So this section would now look like this
<n n="ScopeItems" t="ScopeItems">
<n n="c11091f8-dc69-4e28-8096-9036fe4489f6" t="syslog">
<a n="audit_item_value" t="2" v="10.10.10.10"/>
<a n="tz" v="-2:00"/>
After you make this change, save the file and restart the Configuration Server Service. All future events should come in at the correct time.
If you run into any issues with this or if you would rather have us assist you with this, just let me know and I can open up a ticket with you so that we can do this with you via a remote session.
Thanks!
Michael Purdin
Manager, Technical Support Engineering
