dtime and itime

[mnk26]

I use an external MySQL db for the FAZ. itime and dtime columns in any of the FAZ tables are not normalized into the same time zone. This would be trivial if dtime and itime columns were of type TIMESTAMP, but not so easy since they are INTs. Basically, any dtime value on the FAZ is suspect because we can’t determine if the difference between the itime and dtime is latency or just a time zone difference between the FAZ and the Foritgate. Is there a “best practice” for this that entails setting all Fortigates and FAZ to GMT to forcibly normalize dtime vs itime? How are we supposed to handle this and why are columns with time data not using a time data type?

[Dave_Hall]

Not sure if this answers your question, but our faz and all our fgt devices are synced to the same ntp server (CST or -6 GMT timezone). Whenever one of the fgt devices are out of sync the faz will tell us.

[mnk26]

They may be both synchronized with an ntp server maybe not the same one since they are spread across the country), but they are in different time zones and the timestamps are only stored as INTs so I don' t know the real time they represent.

[Dave_Hall]

The SQL Log Database Query Technote (4.0 MR2), outlines the meaning of the itime and dtime fields, as well it lists another field called timestamp. I would say use the itime field, but I do not know enough about how the times are actually stored. I think it may be UTC.