Question:

Why does session.starttime in DirectAudit Database not match with the local system time (current_timestamp)?

Answer:

This is because the date time stored in the Centrify database is in UTC (Universal Time) format. 

It was designed to be time zone invariant so that DirectAudit Console can report properly at different clients' ends.

This is one of DirectAudit's design requirements so that it can report the datetime using the local time setting on the machine with the installed console. This feature helps the auditor to figure out when the session actually occurs. It is also consistent with all other desktop applications as recommended by Microsoft and should always show the local time.

The difference can be shown by the following query:

To show the session in Pacific Standard Time in SQL, you can try the following SQL statement:

SELECT zone, machinename, DATEADD(hh, -8, starttime) as pstStartTime FROM Session WHERE DATEDIFF(hh, CONVERT(DATETIME, '17530101'), starttime) > 0  ORDER BY pstStartTime