I wonder if it's possible to change time format which Modsecurity 3 uses in its audit log.
I came across that time format differs depending on SecAuditLogFormat
setting.
When it's Native
, timezone is present:
---immbqR4e---A--
[16/Jun/2020:11:24:03 +0300]
But if switched to JSON
, there's no timezone (time is local not the UTC):
"time_stamp":"Tue Jun 16 11:24:03 2020"
This is rather inconvenient for log aggregation and processing, especially when the server running Modsecurity is located in region with daylight saving time. Unfortunately, I couldn't find any information on this issue. I'd appreciate any advice.