All event timestamps are stored in UTC in the App Control database.
The timestamp is the date/time at which the event occurs; that is, it is the time as seen from the source of the event. For example, for server-generated events, it is the UTC time of the server; for agent-generated events, it is the UTC time on the agent computer reporting the event. In the App Control Console, timestamps are displayed according to the time zone setting selected on the General tab of the System Configuration page.
The timestamp for an event corresponds to the date/time when the App Control Agent or Server records the event. This means, for example, that a new file discovery during initialization of all files on a new agent computer will show the time the file is first seen by the agent, not when it first arrived on the computer. If the time on the agent computer is not the same as the time on the server, an agent could report a skewed time, including reporting events as happening at a future time.
