Skip to main content
Bruce7x2
Bruce7x2
Explorer
February 6, 2024
Question

[FortiSIEM]System Time and NTP/RTC Desynchronization

  • February 6, 2024
  • 1 reply
  • 1762 views
Dear Team, 
 
Version: FortiSIEM 7.0.2 (Supervisor & Collector)
Description:
1. I have an environment here where the NTP was originally set up and functioning correctly. However, I've noticed a strange situation where my calibration has gone wrong, and I've observed that the NTP information is not operating correctly. (Please refer to the screenshot below)
fortisiem_time_issue_1.png
fortisiem_time_issue_2.png
fortisiem_time_issue_3.png
fortisiem_time_issue_4.png
 
2. I further turned off the NTP function (timedatectl set-ntp off) and set a fixed time through timedatectl. But
I found that after setting it, the RTC time began to desynchronize with CST/UTC (not synchronized), which I think is abnormal. This situation does not occur in my experimental environment, so I'm wondering if this could be a problem with the system?
fortisiem_time_issue_5.png
Regarding this situation, does the team have any thoughts or suggestions to help me clarify this situation?
Also, should I use the hwclock command to synchronize RTC with CST/UTC?

1 reply

AEK
SuperUser
AEK
SuperUser
February 6, 2024

Hi Bruce

Can you check if you enabled guest clock synchronization at hypervisor level? If so the I thnik this should be disabled not to conflict with NTP.

AEK
    Bruce7x2
    Bruce7x2Author
    Explorer
    March 13, 2024

    Hi AEK,

    Thank you for your response.

    The current situation is that after a holiday, the status has returned to synchronization. Therefore, we are temporarily not continuing to seek the root cause of this issue.

     

    Terms & ConditionsAccessibility statement