FortiSIEM Discussions
Bruce7x2
New Contributor III

[FortiSIEM]System Time and NTP/RTC Desynchronization

Dear Team, 
 
Version: FortiSIEM 7.0.2 (Supervisor & Collector)
Description:
1. I have an environment here where the NTP was originally set up and functioning correctly. However, I've noticed a strange situation where my calibration has gone wrong, and I've observed that the NTP information is not operating correctly. (Please refer to the screenshot below)
fortisiem_time_issue_1.png
fortisiem_time_issue_2.png
fortisiem_time_issue_3.png
fortisiem_time_issue_4.png
 
2. I further turned off the NTP function (timedatectl set-ntp off) and set a fixed time through timedatectl. But
I found that after setting it, the RTC time began to desynchronize with CST/UTC (not synchronized), which I think is abnormal. This situation does not occur in my experimental environment, so I'm wondering if this could be a problem with the system?
fortisiem_time_issue_5.png
Regarding this situation, does the team have any thoughts or suggestions to help me clarify this situation?
Also, should I use the hwclock command to synchronize RTC with CST/UTC?
Bruce Liu
Bruce Liu
3 REPLIES 3
AEK
Honored Contributor II

Hi Bruce

Can you check if you enabled guest clock synchronization at hypervisor level? If so the I thnik this should be disabled not to conflict with NTP.

AEK
AEK
Bruce7x2
New Contributor III

Hi AEK,

Thank you for your response.

The current situation is that after a holiday, the status has returned to synchronization. Therefore, we are temporarily not continuing to seek the root cause of this issue.

 

Bruce Liu
Bruce Liu
FSM_FTNT

this is likely the issue. If you have sync at the hypervisor it will override NTP configuration.