Current machine date time is Sept 25th 2018 06:05PM but there are numerous error/warning logs with FUTURE time, Like 6:23PM. I checked at 6:05PM but not sure when those errors actually happened. How can an event happen in future?
Asked
Active
Viewed 2,061 times
2
Mehdi Anis
- 179
- 2
- 7
-
I do have a VM that is DC. It was running fine, with correct time. I had another VM running, it also had correct time. – Mehdi Anis Sep 25 '18 at 23:16
-
3The time was changed, or the time zone was changed. – Michael Hampton Sep 25 '18 at 23:16
-
Yes, I have changed the timezone. Earlier it was Pacific, I had changed it to Central US couple of hours ago. Haven't restarted the machine yet. That's the reason? – Mehdi Anis Sep 25 '18 at 23:18
-
Events are stamped at the time of the server when the event happened - without timezone information. When the timezone was changed, the server time changed, and thus the timestamps on the event log show in the "future". – Mark Henderson Sep 25 '18 at 23:31
1 Answers
1
Events are stored in UTC time format, not in the local time zone. You can confirm this by double-clicking an event, clicking on "Details" and then selecting "XML View". You will see that the TimeCreated SystemTime is written in UTC.
The event viewer (loaded by the computer management application you use) however seems to display the timestamp of events based on the active time zone when the application was started. As such, you may see confusing times in the event viewer until you restart the application.
Note that the timestamp of events is always based on the system time, so if you change the actual time on the computer, the timestamp of (future) events will change accordingly. So if you set your clock back 10 min, then you would potentially also see events up to 10 min in the future.
Lucky Luke
- 1,654
-
If it answers your question please accept my post as the answer and/or vote it up. Thx. – Lucky Luke Sep 28 '18 at 13:00