topic I'm totally agree with you. in Network Security

ASA 5508-X, FirePower, incorrect syslog timestamp

sharlino — Fri, 21 Feb 2020 14:03:06 GMT

Hello!

I have an ASA 5508-X with FirePower services managed via ASDM.
Versions are:
ASA: 9.6(2)13
ASDM: 7.7(1)
FP: 6.2.0 (Build 362)

I have configured access control policy with logging to external syslog server as well as internal log.
I have configured FirePower module to poll NTP servers. The show time command displays correct time, ASDM displays correct time in every place where timestamp can be checked, linux box (Cisco Fire Linux OS) displays correct time.

Problem: the FirePower module is sending logs with incorrect timestamp to external syslog server.
Have I missed something important or it's possible yet another bug from Cisco ?

Thank you in advance!

Are you sure it isn't logging

Philip D'Ath — Wed, 12 Apr 2017 08:19:05 GMT

Are you sure it isn't logging it in GMT+0?

Are you sure it isn't logging

sharlino — Wed, 12 Apr 2017 09:33:21 GMT

Are you sure it isn't logging it in GMT+0?

Excuse me, how can I verify that?

By the way, for example, syslog shows "Apr 12 08:34:51", but the FP CLI is much different:

 > show time
UTC -       Wed Apr 12 09:11:11 UTC 2017
Localtime - Wed Apr 12 12:11:14 EEST 2017

Because of this, the problem is not in the timezone, in my opinion.

You can verify by going into

Marvin Rhoads — Fri, 14 Apr 2017 08:02:03 GMT

You can verify by going into expert mode on the module doing a quick tcpdump and looking at the content of a syslog message.

>expert
admin@Sourcefire3D:~$ sudo tcpdump -i eth0 -s 0 host <your syslog server>

They're sent unencrypted via udp/514 (edit) so it's pretty easy to look at even in the cli.

Hello Marvin! Thank you for

sharlino — Fri, 14 Apr 2017 08:02:04 GMT

Hello Marvin! Thank you for your response.

I did sniff the traffic, but 514/udp, not 161/udp (SNMP). I did capture on the syslog server side too and the timestamp is incorrect.

Whoops - edited my reply for

Marvin Rhoads — Fri, 14 Apr 2017 08:12:39 GMT

Whoops - edited my reply for the correct port. Thanks.

I believe the log does lag a little bit but I'd expect maybe several seconds of delta - not over 30 minutes like you are seeing.

That sounds like a bug. I'd recommend opening a TAC case.

I'm totally agree with you.

sharlino — Fri, 14 Apr 2017 08:17:51 GMT

I'm totally agree with you. Too high delta, unfortunately. Anyway, appreciate your opinion. Have a nice day.