When an event is captured or an audit action performed the following process takes place:
- Appropriate time stamps (in local time) are generated when an event is created or audited.
- These time stamps are converted from local time to UTC (Coordinated Universal Time) using Windows APIs that take DST (Daylight Savings Time) into consideration.
- The UTC time stamps are then passed to the local CA Data Protection infrastructure. This uses Java APIs to convert the time stamps back to local time and stored as event metadata in the local database. (By contrast, time stamps in blob files are stored in UTC.)
When an event is retrieved from the CMS database the process is reversed:
- On the CMS, the Java layer reads the time stamp (stored in local time) and converts it back to UTC using Java APIs.
- The CMS then passes that UTC time stamp to the CA Data Protection consoles.
- The Data Management console or the browser hosting the iConsole then converts the UTC time stamp to the local time using Windows APIs.
However, if the Database and CMS resides in different time-zones the conversion from UTC on the back to local time (step 4) will reflect the time-zone of the DB and not that of the CMS, leading to the wrong results being displayed.
For other causes of "iConsole search results not as expected", please refer to knowledge Document TEC504046.