cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
726
Views
0
Helpful
7
Replies

Time Settings problem in Sensor / CSPM

senthil
Level 1
Level 1

Hi all

I'm finding difficulties in getting the right time/date on my CSPM IDS Event viewer.

The Date/time settings on CSPM host is perfect.

[GMT+4.00]

But the sensor Bios timings / sysconfig-sensor

timing settings always has conflicts.

For example,, I hv set the Sensor bios settings to Dec22,14:00hrs, but

the date command in sensor gives me Dec 19 4:00 hrs

& the CSPM event viewer shows DEC22,11:55 P.M for an event.

Whatz the perfect way to set the date/time in Sensor??

Thanx in adv & Hv a nice day

Senthil

7 Replies 7

kleem
Cisco Employee
Cisco Employee

The preferred method is to login as root on the Sensor and run sysconfig-sensor. Select Option 7, then Option 2 and follow the prompts.

Hi kmichaelis,

I am having the same problem. I have corrected the time/timezone in option 7 but I still get the same thing. My alarms are 6 hours ahead of current time. My sensor, cspm server, and remote client all have the correct time.

Do you have any other ideas?

JT

kleem
Cisco Employee
Cisco Employee

After setting the timezone, did you adjust the time and then allow the Sensor to reboot when you exited sysconfig-sensor?

Please note that the alarm record includes 2 time fields. The first is GMT and the second is the local time. This may also account for the time difference.

Hi again,

Yes, I just did it again. I changed the timezone to Pacific US and then corrected the time and rebooted. My alarms are still at a wrong time.

Thanks for your help in advance.

JT

I am having the same problem when trying to view the events. May someone advise where can we change the time setting for IDSM ver 2.5(1)S1? Thank you in advance for your kind reply.

kleem
Cisco Employee
Cisco Employee

The IDSM gets its time from the switch. To alter the modules time, change the time on the switch and it will be communicated to the IDSM.

Make sure that you've selected local time in CSPM's Event Viewer preferences tab.

kleem
Cisco Employee
Cisco Employee

The alarm includes both UTC and local time. Verify that you've selected the correct time in the Event Viewers preferences.