Pro tip: set your logs to be all UTC. This will save your forensic analyst (who bills by the hour) the trouble of having to convert timestamps (and even figuring out which timestamps are in which TZ).

It also keeps them ordered correctly when forwarded to a SIEM, especially from multiple TZ's.