Troubleshooting Tip: Simple steps to follow if there is a time mismatch between the Dashboard and the System Logs or Forward Traffic Logs

The time seen on the FortiGate and the time seen on logs may be mismatched for various reasons, including the summer time change.

The first recommended step is to check if the NTP servers are reachable. See Technical Tip: Troubleshoot NTP synchronization issue.

If the servers are reachable (which is the expected on this scenario as the behavior is not related to the NTP servers being unreachable), the following steps can be followed:

• Under System -> Settings, check if the option 'Browser timezone is selected'.

This might cause the logs to be shown with the browser time zone and not the FortiGate one.

For reference:

Alternatively, changing the option from FortiGate timezone to Browser timezone can help with the behavior, depending on the expected time to be seen on the Logs, according to the specific timezone.

• As a second step, on the System Settings, the time can be changed to any other timezone or set it manually, save the change and then revert it back to the original one.

For reference, the change will be made on the following option as seen:

• Lastly, restarting the NTP process and the miglogd process (related to logging) may be helpful in this scenario.

Refer to the following articles on how to achieve this:

• Technical Tip: Find and restart/kill a process on a FortiGate by the process ID (PID) via pidof
• Technical Tip: How to restart/kill one or several processes on the FortiGate with CLI commands

If none of these steps help with the behavior, a new case with TAC support team can be created, including the outputs to the troubleshooting commands used for NTP.