Most programs read the timezone settings once at start-up and won't expect them to change while the program is running.
So, you'll need to restart any programs with incorrect timezone:
root@debian:~: systemctl restart rsyslog
root@debian:~: systemctl restart apache2
You should also update the initramfs file, so that the correct timezone will be set as early as possible in the boot process:
root@debian:~: update-initramfs -u
It looks like Apache might be using the UTC timezone. That might be intentional: it is possible to use the
TZ environment variable to set a specific timezone to specific programs, if e.g. some sort of log post-processing requires the logs of some services to be in UTC time. This might be set in
Your syslog daemon might be using the US Eastern timezone. That is a common "factory default" for US-centric software, and is probably what your timezone was set to before you changed it to Tehran.
(I would have expected Debian to use UTC as the factory default instead, but perhaps there are some historical backwards compatibility reasons why not.)