Cisco FMC not showing events

[Davion Stewart]

Good day all, 

Currently we have deployed Cisco FMC 1600 with FTD 1020 and 2100 in HA respectively. 

We are running version 6.4.0.4.

The FMC has been configured to sync time via NTP and is showing the correct time. 

The FTDs have been configured to pull time via platform setting from the same NTP server and are syncing fine. 

The time on the FTD is showing the correct time as well. 

When checking logs in the Analysis >> Connections >>  Events or even the dashboards no events are seen. 

If you check 24 hours before the current time you can see that events are happening. 

Why are we only able to see events 24 hours ago? 

[nspasov]

Hi there! Quick question: Are you saying that you are only able to see events for one day, or are you saying that you can see all of your events but they are displaying 24 hours behind the current time?

Thank you for rating helpful posts!

[Davion Stewart]

Good day,

I'm saying that i can see all of my events but they are displaying 24 houra behind the current time

[nspasov]

Hmm, that is very strange and something that I have not seen before. I just tested in my lab with 6.4.0.4 and could not replicate your issue. At this point, it is probably best if you reach out to Cisco TAC for additional support. Please keep us posted if you are able to find a resolution. 

Thank you for rating helpful posts!

[Davion Stewart]

Will open the case and see what Cisco says. Thanks

[Massimo Baschieri]

24 hours is a lot of time, I experienced a few hours skew in the past and it turned out to be an incorrect user time zone setting.

Check Admin->User Preferences 

[Davion Stewart]

Yup, checked that already and user is in the correct time zone. Will open a case and provide feedback.
Thanks

[Davion Stewart]

Providing an update on this.
What has been realized is that the hardware clock and the software clock time is off by 12 hours.
So if you go to Analysis >>> Connection Events, and then change the time filter to 12 hours previously, you will then be able to see events.
Working with TAC on the issue, we have a couple fixes to resolve the clock times being off but to no avail.
This seems to be a new issue so still waiting on feedback from the business unit.
Will let you know what happens.