# Record and timestamp problem in audit.log **URL:** \ **Category:** Percona Server for MySQL 8.0\ **Created:** [March 30, 2022, 12:24pm UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989 "2022-03-30T12:24:16Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bthnklc](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@bthnklc](https://forums.percona.com/u/bthnklc)\ **Post date:** [March 30, 2022, 12:24pm UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989/1 "2022-03-30T12:24:16Z")
Hello everyone, we use audit\_log\_plugin from Percona (Percona XtraDB Cluster (GPL), Release rel15, Revision 8638bb0, WSREP version 26.4.3 ) + innodb\_version | 8.0.25-15 the plugin is working. I have problem , record time is not valid. record and timestamp is three hours behind system clock. I am sending the audit log content to qradar using syslog. I need one of two solutions here. the first is to remove the record and timestamp from the Auditlog. the second is to ensure that the times are seen correctly in the auditlog. {“audit\_record”:{“name”:“Query”,“record”:“412200305\_2022-03-30T07:42:03”,“timestamp”:“2022-03-30T07:58:47Z” … root@mysql8:date Wed 30 Mar 2022 10:59:42 AM +03 I request your information about this problem. Best regards. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [March 30, 2022, 4:20pm UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989/2 "2022-03-30T16:20:54Z")
@bthnklc Can you do `SELECT NOW()` and compare that timestamp to the OS and audit log entries? Have you also checked the OS timezone compared to MySQL’s timezone setting? If every entry is always 3 hrs off, then I suspect you have some TZ-config-related issue. ---
**Author:** ![bthnklc](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@bthnklc](https://forums.percona.com/u/bthnklc)\ **Post date:** [March 30, 2022, 4:44pm UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989/3 "2022-03-30T16:44:06Z")
Hi @matthewb , thank for your reply. The timezone I specified on the operating system and database is used. There is no historical problem in the database.“Time zone: Europe/Istanbul (+03, +0300)” Below are the timezone outputs related to the problem. I haven’t been able to make any progress on what to do about it. ☹ Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 1135 Server version: 8.0.25-15.1 Percona XtraDB Cluster (GPL), Release rel15, Revision 8638bb0, WSREP version 26.4.3 Copyright (c) 2009-2021 Percona LLC and/or its affiliates Copyright (c) 2000, 2021, Oracle and/or its affiliates. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the current input statement. mysql\> SELECT NOW(); ±--------------------+ | NOW() | ±--------------------+ | 2022-03-30 19:29:15 | ±--------------------+ 1 row in set (0.00 sec) mysql\> show variables like ‘%zone%’; ±-----------------±-------+ | Variable\_name | Value | ±-----------------±-------+ | system\_time\_zone | +03 | | time\_zone | SYSTEM | ±-----------------±-------+ 2 rows in set (0.01 sec) mysql\> SELECT @@global.time\_zone, @@session.time\_zone; ±-------------------±--------------------+ | @@global.time\_zone | @@session.time\_zone | ±-------------------±--------------------+ | SYSTEM | SYSTEM | ±-------------------±--------------------+ 1 row in set (0.00 sec) mysql\> exit Bye root@mysql8-03:~# timedatectl Local time: Wed 2022-03-30 19:30:27 +03 Universal time: Wed 2022-03-30 16:30:27 UTC RTC time: Wed 2022-03-30 16:30:27 Time zone: Europe/Istanbul (+03, +0300) System clock synchronized: yes NTP service: n/a RTC in local TZ: no root@mysql8-03:~# date Wed 30 Mar 2022 07:31:03 PM +03 ---
**Author:** ![remzi.akyuz](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/remzi.akyuz/32/6194_2.png) [@remzi.akyuz](https://forums.percona.com/u/remzi.akyuz)\ **Post date:** [April 2, 2022, 1:07am UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989/4 "2022-04-02T01:07:42Z")
Hi @matthewb , It look likes a issue. Percona has any plan about this issue? [https://bugs.mysql.com/bug.php?id=84961](https://bugs.mysql.com/bug.php?id=84961) Thanks for your time. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [April 2, 2022, 3:46am UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989/5 "2022-04-02T03:46:25Z")
According to the bug you provided, it is not an issue/bug. Timestamp information in the audit log is always logged in UTC. The manual states this. The bug you linked is a feature request to have the audit timestamp be timezone sensitive. For now, the solution seems to have your qradar parse the timestamp in UTC and convert it on import. ---
**Author:** ![remzi.akyuz](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/remzi.akyuz/32/6194_2.png) [@remzi.akyuz](https://forums.percona.com/u/remzi.akyuz)\ **Post date:** [April 2, 2022, 9:57pm UTC](https://forums.percona.com/t/record-and-timestamp-problem-in-audit-log/14989/6 "2022-04-02T21:57:48Z")
Thanks for your information.