Hello,
I am running Suricata 8.0.7 RELEASE (64-bit Windows build) on Windows 11 Pro and have encountered what appears to be an incorrect timezone offset in the EVE JSON timestamps.
My Windows system is configured for Eastern Time (US & Canada):
-
Windows Time Zone:
Eastern Standard Time -
Standard offset:
UTC-05:00 -
Daylight Saving Time: Enabled
-
Current date: September 22, 2026
-
Current DST offset:
UTC-04:00
Windows/.NET correctly reports:
Local time: 18:00
UTC time: 22:00
Current offset: -04:00
DST: True
However, Suricata 8.0.7 is writing EVE timestamps such as:
"timestamp":"2026-09-22T18:00:22.333339-0600"
The clock time itself is correct, but the timezone offset is incorrect. It should be:
2026-09-22T18:00:22.xxxxxx-0400
The same incorrect -0600 offset also appears in other Suricata-generated timestamps, including flow.start and stats.
OpenSearch is not changing the timestamp. The raw EVE JSON file produced directly by Suricata already contains the incorrect -0600 value.
I have also verified:
tzutil /g
Eastern Standard Time
and the Windows timezone registry values are:
TimeZoneKeyName : Eastern Standard Time
Bias : 300
StandardBias : 0
DaylightBias : -60
DynamicDaylightTimeDisabled : 0
Windows native timezone APIs also report that the system is currently observing daylight time.
The Suricata process is running normally and is loading:
C:\Windows\System32\msvcrt.dll
C:\Windows\System32\ucrtbase.dll
D:\WinSuricata\Suricata\libwinpthread-1.dll
There is no TZ environment variable configured.
I have not modified the Suricata source code or attempted to compensate for the problem by changing the Windows timezone.
Could you please confirm whether this is a known Windows-specific timestamp/timezone issue in Suricata 8.0.7, and whether there is a recommended fix or newer Windows build that addresses it?
Thank you.