Security Compliance
SEM-Microsoft IIS Log Detection Time is off by an hour
This article explains what to do if IIS logs that are being posted to SEM are exactly an hour off between the Insertion Time and Detection Time. By default, Microsoft IIS logs are logged in GMT.
First published date
11/8/2018 7:02 PM
Last published date
11/8/2018 7:02 PM
Overview
IIS logs that are being posted to Security Event Manager (formerly Log & Event Manager) are exactly an hour off between the Insertion Time and Detection Time. By default, Microsoft IIS logs are logged in GMT.
Product section
Security Event Manager
Cause
Even though the IIS logs to GMT, the IIS logs are dependent on the local time of the computer. This problem is caused with the time shift of daylight savings time on the IIS Web Server.
Resolution
Make sure the the check box is selected for Use Daylight Savings even if you have the have set the logs in GMT.