I'm running into an issue with SmartZone logging. After some digging, it appears that the SmartZone is storing events internally with UTC timestamps, but showing them in local time (EST, -5) from within the SmartZone web interface since that's the timezone set on the device. However, when the SmartZone ships those event logs off via syslog, it sends them with a UTC timestamp with no timezone information.
I'm trying to set up Graylog as a centralized logging solution, and it interprets unmarked timestamps as being in local time (appropriately, per ISO8601 and RFC5424). Therefore, it sees those syslog messages from the SmartZone as coming from 5 hours in the future.
So, for instance, the SmartZone sends "Feb 11 20:45:50", but it should send either "Feb 11 20:45:50Z" or "Feb 11 15:45:50-05:00". It looks like the current SmartZone implementation is maybe using the older syslog spec (RFC3164), which does not require any time zone information (but does allow for it). Has anyone else run into this issue? Is there a fix for it on the Ruckus side of things? Or can I file a feature request/bug report somewhere to have the SmartZone syslog use a more up-to-date, unambiguous time format?
