[FortiSIEM]System Time and NTP/RTC Desynchronization

[Bruce7x2]

Dear Team, 

Version: FortiSIEM 7.0.2 (Supervisor & Collector)

Description:

1. I have an environment here where the NTP was originally set up and functioning correctly. However, I've noticed a strange situation where my calibration has gone wrong, and I've observed that the NTP information is not operating correctly. (Please refer to the screenshot below)

2. I further turned off the NTP function (timedatectl set-ntp off) and set a fixed time through timedatectl. But

I found that after setting it, the RTC time began to desynchronize with CST/UTC (not synchronized), which I think is abnormal. This situation does not occur in my experimental environment, so I'm wondering if this could be a problem with the system?

Regarding this situation, does the team have any thoughts or suggestions to help me clarify this situation?

Also, should I use the hwclock command to synchronize RTC with CST/UTC?

[AEK]

Hi Bruce

Can you check if you enabled guest clock synchronization at hypervisor level? If so the I thnik this should be disabled not to conflict with NTP.

[Bruce7x2]

Hi AEK,

Thank you for your response.

The current situation is that after a holiday, the status has returned to synchronization. Therefore, we are temporarily not continuing to seek the root cause of this issue.

[FSM_FTNT]

this is likely the issue. If you have sync at the hypervisor it will override NTP configuration.