Syslog message (EventSource) creation date issue

12 minutes ago, Stuart Weenig said:

Once you have a global infrastructure, honestly, all systems should be using UTC to store time. This removes all issues of time zone and DST. If you want to display something in a different time, use a tool's TZ/DST offset feature to display it in your local time. 

We're talking about client infra which we don't manage. Regardless of what's the optimal procedure, we should be able to control that on the tool end. Doesn't make sense to have an alert start date other than the time it actually hit the tool.