8.6  Interpreting Time Stamps

If an event in a binary log includes a Storage Event Header (SEH) or Common Event Header (CEH), that information is used to provide the time stamp information for analysis and translation results. If the event only includes a Windows NTŪ header, no time stamp is included with analysis results.

In addition, when you translate an event that includes a SEH or CEH header in addition to a Windows NT header, both time stamps are shown in the translation results. However, unless the system responsible for logging the event is located in the GMT time zone, the time stamps will be different.

The event time also is displayed in the event description (located at the top of a translated event). Depending on the contents of the event and the SEA interface used to translate it, the translated output may include different information:

SEH and CEH Headers

SEH and CEH time stamps are stored as strings and reported in the TLV_Time_as_Local field of a translated event. This field has the following format:

Jan 11, 2002 3:06:09 AM GMT-0600

This indicates the time the event was logged, in the time zone where the system responsible for logging the event is located. The time zone is shown as an offset, in hours, from GMT.

Windows Headers

The Windows NT header stores time stamp information as an integer indicating the number of seconds that have elapsed since epoch (January, 1 1970 00:00:00 AM GMT). These integers are translated into a date and time and reported in the WNT_GMT_Time_Generated and WNT_GMT_Time_Written fields of a translated event using the following format:

Jan 11, 2002 9:06:09 AM GMT

Since the Windows NT header does not include any information about the time zone where the logging system is located, the GMT time zone is used. This does not mean the logging system is located in the GMT time zone.