Suricata

Hello,

I am running Suricata 8.0.7 RELEASE (64-bit Windows build) on Windows 11 Pro and have encountered what appears to be an incorrect timezone offset in the EVE JSON timestamps.

My Windows system is configured for Eastern Time (US & Canada):

• Windows Time Zone: `Eastern Standard Time`
• Standard offset: `UTC-05:00`
• Daylight Saving Time: Enabled
• Current date: September 22, 2026
• Current DST offset: `UTC-04:00`

Windows/.NET correctly reports:

Local time: 18:00
UTC time: 22:00
Current offset: -04:00
DST: True

However, Suricata 8.0.7 is writing EVE timestamps such as:

"timestamp":"2026-09-22T18:00:22.333339-0600"

The clock time itself is correct, but the timezone offset is incorrect. It should be:

2026-09-22T18:00:22.xxxxxx-0400

The same incorrect `-0600` offset also appears in other Suricata-generated timestamps, including `flow.start` and `stats`.

OpenSearch is not changing the timestamp. The raw EVE JSON file produced directly by Suricata already contains the incorrect `-0600` value.

I have also verified:

tzutil /g
Eastern Standard Time

and the Windows timezone registry values are:

TimeZoneKeyName : Eastern Standard Time
Bias : 300
StandardBias : 0
DaylightBias : -60
DynamicDaylightTimeDisabled : 0

Windows native timezone APIs also report that the system is currently observing daylight time.

The Suricata process is running normally and is loading:

C:\Windows\System32\msvcrt.dll
C:\Windows\System32\ucrtbase.dll
D:\WinSuricata\Suricata\libwinpthread-1.dll

There is no `TZ` environment variable configured.

I have not modified the Suricata source code or attempted to compensate for the problem by changing the Windows timezone.

Could you please confirm whether this is a known Windows-specific timestamp/timezone issue in Suricata 8.0.7, and whether there is a recommended fix or newer Windows build that addresses it?

Thank you.