According to the session query result, the session log time does not match the session end time by several hours.
1. Change the time zone on the firewall to that on the log server. clock timezone c8 add 08:00:00
c8 is a customized time zone. The following takes Beijing time as an example. Beijing time is eight hours earlier than the default Universal Time Coordinated (UTC) on the firewall. Therefore, you can use add 08:00:00. If the time is later than the UTC, use minus.
You should select add or minus according to the related configuration manual of the firewall.
2. Change the time on the firewall to that of the log server. For example, set the current date on the firewall to 00:00:00 on November 1, 2005.clock datetime 0:0:0 2005/11/01
3. After the device time is changed, if the fault persists, contact Huawei Symantec Engineers.
The time zone and time on the log server do not match those on the firewall.