On Demand Scan Activity.log date and time incorrect

[Former Member]

Hi,
Recently I migrated to version 10.7.0.1285 of the Mcafee EndPoint Security, but it happens that when I check the endpoint logs I get an incorrect time and date for tasks or activity logging. example:

log:

OnDemandScan_Activity LogDATE/TIME PC

I would like to know if you can help me solve this problem?

Thanks a lot

McAfee Endpoint Security

[AdithyanT]

Hi @Former Member,

Thank you for your post! May I know what timezone your local PC follows?

Also can you help me with the exact time stamp of a log activity from the log file and the time on your machine when the activity commenced for a quick comparison?

I am trying to find the time difference between the once present in the log and the one followed by your machine and see what timezone is being used by the product for logging!

[Former Member]

Hi,

Thanks for your attention, my PC currently has the following time zone configured:  (UTC-04:00) Georgetown, La Paz, Manaus, San Juan.

This is the information of an analysis on demand performed at this time.

2020-01-14 13:22:11.096Z|Activity|odsbl |mfetp | 11172| 19004|ODS |odsruntask.cpp(1884) | Scan started

2020-01-14 13:22:11.179Z|Activity|odsbl |mfetp | 11172| 17240|ODS |odsruntask.cpp(2514) | Scan auto paused

The current time and date is:

‎Date: Tuesday, ‎January ‎14, ‎2020,  Time: ‎9:33 AM

Thanks a lot

[AdithyanT]

Hi @Former Member,

Thank you for your response! I am afraid I may end up repeating what @Former Member has already said below! Our Endpoint Security Scan logs are by default logged in UTC/GMT time zones. Owing to this, although you are running at UTC-4 timezone, the logs are being recorded in UTC timezone and hence showing this difference in time recorded.

I sincerely hope this clarifies your query!

[Former Member]

Hi @AdithyanT and @Former Member ,

I really find this strange because in our environment I also have version 10.6.1 of the ENS and this if I log the log with the real time of the PC.
example of an analysis executed right now.

14/1/2020 10:09:00 a. m. mfetp(5408.9408) <SYSTEM> odsbl.ODS.Activity: Scan started

14/1/2020 10:09:00 a. m. mfetp(5408.18760) <SYSTEM> odsbl.ODS.Activity: Scan auto paused

current time: 10:15 am.

Thank.

[Former Member]

Hi @Former Member 

This looks like expected behaviour. The logs are written in UTC (as you can see from the top of the log). I assume that 3pm (local time) on the 11/01 just happens to be 4am on the 12/01 in UTC.

[Former Member]

Hi,

if so, this would be a bit complicated to gather information for evidence and in terms of the execution of tasks since it would not be executed at the scheduled time as it currently happens. Example: I have a client task to run at 3:00 pm every day and I see that it is done at dawn.

I find this a bit strange because I come from several versions of VSE and ENS from mcafee and the log is always stored under the real time and date.

I would like to know how to solve this ?.

thanks

[ton009]

I have a similar issue.

The ePO time is exactly as my pc time. They are in sync. Even when I do a schedule task - they are in sync.

The problem is that when opening the log(onDemandScan_Activity.log) the timestamp is 1hr late.

Regards

MT

[AdithyanT]

Hi @ton009 and @Former Member 

Thank you for your responses. I am afraid this is the current working of the product as confirmed in my setups internally as well.

If this requires to be modified, i would recommend raising a PER for our product management team to look into the same.

https://kc.mcafee.com/corporate/index?page=content&id=KB60021

Kindly please note that this is the behavior of the product and not an issue at the moment.

[AdithyanT]

Hi @ton009, @Former Member,

I would like to add some information here. This change of Logging format is documented and is found to be present only from ENS 10.7 as documented here:

https://docs.mcafee.com/bundle/endpoint-security-10.7.x-common-client-interface-reference-guide-windows/page/GUID-3FE6F59F-BBC0-4E6B-B434-7BD0EEAF2C50.html

I sincerely hope this clarifies the issue here!