Summary

When using Splunk as the action log backend, changing a repository mirror's Sync Start Date logs the datetime as a raw ISO string (e.g. "2026-02-26 18:00:00") instead of a properly formatted localized date. This is caused by the same Splunk serialization issue described in PROJQUAY-10585.

Steps to Reproduce

1. Deploy Quay 3.17 with LOGS_MODEL: splunk
2. Create a mirror repository configuration
3. Change the Sync Start Date in the mirror settings like 2/25/2026, 06:10:00 AM
4. Navigate to repository Logs tab or Superuser > Usage Logs
5. Observe the repo_mirror_config_changed log entry

Expected Result

The log entry should show a properly formatted localized date:
"Mirror Sync Start Date changed to 2/25/2026, 06:10:00 AM"

Actual Result

The log entry shows a raw ISO string:
"Mirror Sync Start Date changed to 2026-02-24 22:10:00"

Splunk Raw data

{"account": "test-inject", "datetime": "2026-02-13 10:13:39.217242", "ip": "10.128.4.37", "kind": "repo_mirror_config_changed", "metadata_json": {"changed": "mirror_rule", "namespace": "test-inject", "repo": "mirrorrepo", "resolved_ip": {"aws_region": null, "continent": null, "country_iso_code": null, "provider": "internet", "service": null, "sync_token": "1645662201"}, "to": ["*"], "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0", "username": "quay"}, "performer": "quay", "repository": "mirrorrepo"} 

Splunk server in a different timezone of my local client  

Root Cause

When the mirror sync_start_date is changed, the backend logs a datetime object:

# endpoints/api/mirror.py:421-429
sync_start_date = self._string_to_dt(values["sync_start_date"])  # datetime object
if model.repo_mirror.change_sync_start_date(repo, sync_start_date):
    track_and_log(
        "repo_mirror_config_changed",
        wrap_repository(repo),
        changed="sync_start_date",
        to=sync_start_date,  # datetime object passed as metadata
    )

The Splunk producer serializes this via json.dumps(log, default=str), converting the datetime to an ISO string "2026-02-26 18:00:00".

The UI description at web/src/hooks/UseLogDescriptions.tsx:250-252 uses simple string interpolation:

case 'sync_start_date':
  metadata.changed = 'Sync Start Date';
  return `Mirror $\{metadata.changed} changed to $\{metadata.to}`;

This displays the raw ISO string directly without any date formatting.

Impact

1.  Audit log date mismatch: User sets 02/25/2026, 10:10 PM (local UTC+8), but the log shows 2026-02-24 22:10:00 — the date crosses the day boundary due to timezone conversion
2. No timezone indicator: The raw ISO string in the log has no timezone info, making it ambiguous
3. Round-trip timezone bug in config UI: formatDateForInput() uses .toISOString() (UTC) but feeds it to a datetime-local input that interprets values as local time — so reloading the page would shift the displayed time

Related

• PROJQUAY-10585 - Splunk log producers serialize datetime as ISO string instead of epoch (same root cause)
• PROJQUAY-10570 - tag expiration wrong time

Environment

• Quay version: 3.17.0
• Action log backend: Splunk
• Cluster: OCP4.20