5.6 Interpreting Time Stamps
If an event in a binary log includes a Storage Event Header (SEH) or Common Event Header (CEH), that information is used to provide the time stamp information for analysis and translation results. If the event only includes a Windows NT header, no time stamp is included with analysis results.
In addition, when you translate an event that includes a SEH or CEH header in addition to a Windows NT header, both time stamps are shown in the translation results. However, unless the machine responsible for logging the event is located in the GMT time zone, the time stamps will be different.
The event time is also displayed in the event description (located at the top of a translated event). Depending on the contents of the event and the SEA interface used to translate it, the translated output may include different information:
- If the event includes a SEH or CEH header, the time stamp information from that header is included in the event description. If the header has invalid date information the current date is shown along with an error message.
- If you are using the web interface and the event only has a Windows header, no date information is shown in the event description.
- If you are using the CLI to send the translation to the screen or a text file and the event only has a Windows header, the date information from the header is included in the event description.
- If you are using the CLI to send the translation to a HTML file and the event only has a Windows header, no date information is shown in the event description.
SEH and CEH time stamps are stored as strings and reported in the TLV_Time_as_Local field of a translated event. This field has the following format:
Jan 11, 2002 3:06:09 AM GMT-0600This indicates the time the event was logged, in the time zone where the machine responsible for logging the event is located. The time zone is shown as an offset, in hours, from GMT.
The Windows NT header stores time stamp information as an integer indicating the number of seconds that have elapsed since epoch (January, 1 1970 00:00:00 AM GMT). These integers are translated into a date and time and reported in the WNT_GMT_Time_Generated and WNT_GMT_Time_Written fields of a translated event using the following format:
Jan 11, 2002 9:06:09 AM GMTSince the Windows NT header does not include any information about the time zone where the logging machine is located, the GMT time zone is used. This does not mean the logging machine is located in the GMT time zone.