configuration clock module IPS

Unanswered Question
Jun 9th, 2010
User Badges:

I am setting my IPS module but I have trouble putting on the hour. I'm doing it via NTP but when I go to events I get the hour badly adds six coreg hour. I can do to this.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Scott Fringer Wed, 06/09/2010 - 09:47
User Badges:
  • Cisco Employee,

Have you also configured the timezone offset  and timezone on the sensor?


conf t

service host

time-zone-settings

offset


Scott

alfredoelias Thu, 06/10/2010 - 08:45
User Badges:

time-zone-settings

standard-time-zone-name CST


offset 0

exit

ntp-server 201.247.152.233

sh clock

21:15:22 CST Tue Jun 08 2010

This is the configuration and the problem persists











Scott Fringer Thu, 06/10/2010 - 09:06
User Badges:
  • Cisco Employee,

That's the problem - your offest from GMT is set to 0.  For CST the offset should be -360 with the CDT offset automatically changing to -300 (when you enable summertime in the configuration)


Scott

alfredoelias Thu, 06/10/2010 - 09:31
User Badges:

exit

offset -360

standard-time-zone-name CST

exit

ntp-server 201.247.152.233

the problem persist

Scott Fringer Thu, 06/10/2010 - 09:51
User Badges:
  • Cisco Employee,

Could you provide the following output:


sh clock

sh stat host


Scott

Scott Fringer Thu, 06/10/2010 - 10:43
User Badges:
  • Cisco Employee,

I see the 'sh stat host' output, which indicates successful NTP server synchronization.


I do not see the current output of 'sh clock'.


From the output, is this an AIP-SSM or an IDSM-2 or a different IPS module?


Scott

alfredoelias Thu, 06/10/2010 - 11:45
User Badges:

Hi Scott


thanks for you help this is module IPS in ASA I send the show


ROM-TLC-MIPS-01# sh clock
11:25:31 CST Thu Jun 10 2010


the time is corect but in my view IPS events shows me the 6 hours in advance

Scott Fringer Thu, 06/10/2010 - 11:48
User Badges:
  • Cisco Employee,

OK - so the time is correct on the sensor; that is now confirmed.


Where are you viewing the events that you are seeing the 6 hour time difference?  Are you using IEV, IME, CS-MARS, another tool?


Scott

alfredoelias Thu, 06/10/2010 - 11:51
User Badges:

I can see events in the IPS monitor I do not use anything else only IPS

Scott Fringer Thu, 06/10/2010 - 11:55
User Badges:
  • Cisco Employee,

The event viewer within IDM should present the event in both the sensor local time and sensor UTC time.


Events displayed on the CLI of the sensor via 'sh even alert' should also provide the event time in both local time and UTC time


Scott

Actions

This Discussion