2 Replies Latest reply on Jan 22, 2012 2:06 AM by mfrieden

    Feature Request - LEM - Sophos Email Appliance syslog tool.

    mfrieden

      I have the latest tool for the Sophos Email Appliance.  Everything works fine except for one thing.  The Email Appliance sends the syslogs over with GMT.  The Insertion Time and Detection Time, in my case, are 7 hours apart.  This makes it difficult to have a good response window when creating a rule.  My response window is currently set at 8 hours for a rule I created.  I get some false positives.

      It seems that adding a feature to the tool to enable an adjustable offset to the Detection Time would be an easy fix.

      I've checked the Sophos Email Appliance and there's no setting to put syslog in local time rather than GMT.  I asked Sophos about it and they say it would be a feature request for them too.

      So who's going to come up with a fix first?

      Thanks.